deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22688
Published: 2025-02-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/unlimited-page-sidebars/vulnerability/wordpress-unlimited-page-sidebars-plugin-0-2-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22690
Published: 2025-02-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/digitimber-cpanel-integration/vulnerability/wordpress-digitimber-cpanel-integration-plugin-1-4-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22691
Published: 2025-02-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows SQL Injection.This issue affects WP Travel: from n/a through <= 10.1.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-travel/vulnerability/wordpress-wp-travel-plugin-10-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22693
Published: 2025-02-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows SQL Injection.This issue affects Contest Gallery: from n/a through <= 25.1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-25-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22694
Published: 2025-02-03
Description: Missing Authorization vulnerability in Dotstore Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce.This issue affects Hide Shipping Method For WooCommerce: from n/a through <= 1.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hide-shipping-method-for-woocommerce/vulnerability/wordpress-hide-shipping-method-for-woocommerce-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22695
Published: 2025-02-03
Description: Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through <= 3.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/nirweb-support/vulnerability/wordpress-nirweb-support-plugin-3-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22701
Published: 2025-02-03
Description: Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/traveler-layout-essential-for-elementor/vulnerability/wordpress-traveler-layout-essential-for-elementor-plugin-1-0-8-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-22703
Published: 2025-02-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through <= 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/forge/vulnerability/wordpress-forge-front-end-page-builder-plugin-1-4-6-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22704
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abinav Thakuri WordPress Signature wordpress-signature allows Reflected XSS.This issue affects WordPress Signature: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wordpress-signature/vulnerability/wordpress-wordpress-signature-plugin-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-22775
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/intelligent-importer/vulnerability/wordpress-catalog-importer-scraper-crawler-plugin-5-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23491
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through <= 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vstemplate-creator/vulnerability/wordpress-vstemplate-creator-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23527
Published: 2025-02-03
Description: Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC Wallet: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wc-wallet/vulnerability/wordpress-wc-wallet-plugin-2-2-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-23561
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-audio-player allows Stored XSS.This issue affects MLL Audio Player MP3 Ajax: from n/a through <= 0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/music-let-loose-mp3-audio-player/vulnerability/wordpress-mll-audio-player-mp3-ajax-plugin-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23581
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Demo User DZS demo-user-dzs-showcase-your-admin-safely allows Stored XSS.This issue affects Demo User DZS: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/demo-user-dzs-showcase-your-admin-safely/vulnerability/wordpress-demo-user-dzs-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23582
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign allows Reflected XSS.This issue affects Bulk Categories Assign: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bulk-categories-assign/vulnerability/wordpress-bulk-categories-assign-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23588
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in baonguyenyam WOW Best CSS Compiler best-css-compiler allows Reflected XSS.This issue affects WOW Best CSS Compiler: from n/a through <= 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/best-css-compiler/vulnerability/wordpress-wow-best-css-compiler-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23590
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This issue affects Dezdy: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dezdy-mcommerce/vulnerability/wordpress-dezdy-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23591
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blulogistics1 blu Logistics blu-logistics allows Reflected XSS.This issue affects blu Logistics: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blu-logistics/vulnerability/wordpress-blu-logistics-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23593
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha EmailPress emailpress allows Reflected XSS.This issue affects EmailPress: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/emailpress/vulnerability/wordpress-emailpress-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23594
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uzzal Mondal Google Map With Fancybox location-piker allows Reflected XSS.This issue affects Google Map With Fancybox: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/location-piker/vulnerability/wordpress-google-map-with-fancybox-plugin-2-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23599
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aarvansh Infotech eMarksheet emarksheet allows Reflected XSS.This issue affects eMarksheet: from n/a through <= 5.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/emarksheet/vulnerability/wordpress-emarksheet-plugin-5-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23614
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in niksudan WordPress Additional Logins wp-additional-logins allows Reflected XSS.This issue affects WordPress Additional Logins: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-additional-logins/vulnerability/wordpress-wordpress-additional-logins-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23685
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebTechGlobal RomanCart romancart-on-wordpress allows Reflected XSS.This issue affects RomanCart: from n/a through <= 0.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/romancart-on-wordpress/vulnerability/wordpress-romancart-on-wordpress-plugin-0-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23747
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Awesome Timeline awesome-timeline allows Stored XSS.This issue affects Awesome Timeline: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-timeline/vulnerability/wordpress-awesome-timeline-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23755
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through <= 2.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pafacile/vulnerability/wordpress-pafacile-plugin-2-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23799
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tube-video-curator/vulnerability/wordpress-tube-video-curator-plugin-1-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23819
Published: 2025-02-03
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Marco Milesi WP Cloud cloud allows Absolute Path Traversal.This issue affects WP Cloud: from n/a through <= 1.4.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/cloud/vulnerability/wordpress-wp-cloud-plugin-1-4-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-23920
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sourcing Team ApplicantPro applicantpro allows Reflected XSS.This issue affects ApplicantPro: from n/a through <= 1.3.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/applicantpro/vulnerability/wordpress-applicantpro-plugin-1-3-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23923
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wackey Lockets lockets allows Reflected XSS.This issue affects Lockets: from n/a through <= 0.999.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lockets/vulnerability/wordpress-lockets-plugin-0-999-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23984
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Reflected XSS.This issue affects Dynamic URL SEO: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dynamic-url-seo/vulnerability/wordpress-dynamic-url-seo-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24536
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk thrivedesk allows Reflected XSS.This issue affects ThriveDesk: from n/a through <= 2.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/thrivedesk/vulnerability/wordpress-thrivedesk-plugin-2-0-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24541
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DK White Label dk-white-label allows Reflected XSS.This issue affects DK White Label: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dk-white-label/vulnerability/wordpress-dk-white-label-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24544
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashed-slug.net Bitcoin and Altcoin Wallets wallets allows Reflected XSS.This issue affects Bitcoin and Altcoin Wallets: from n/a through <= 6.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wallets/vulnerability/wordpress-bitcoin-and-altcoin-wallets-plugin-6-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24545
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bsk-gravity-forms-custom-validation/vulnerability/wordpress-bsk-forms-validation-plugin-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24556
Published: 2025-02-03
Description: Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWoodle: from n/a through <= 3.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://patchstack.com/database/Wordpress/Plugin/moowoodle/vulnerability/wordpress-moowoodle-plugin-3-2-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-24557
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through <= 3.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-plugin-3-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24559
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.15.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-15-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24569
Published: 2025-02-03
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Path Traversal.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/pdf-generator-addon-for-elementor-page-builder/vulnerability/wordpress-pdf-generator-addon-for-elementor-page-builder-plugin-1-7-5-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2025-24574
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader pepro-bacs-receipt-upload-for-woocommerce allows Reflected XSS.This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through <= 2.6.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pepro-bacs-receipt-upload-for-woocommerce/vulnerability/wordpress-peprodev-woocommerce-receipt-uploader-plugin-2-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24576
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Reflected XSS.This issue affects Landing Page Cat: from n/a through <= 1.7.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/landing-page-cat/vulnerability/wordpress-landing-page-cat-plugin-1-7-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24605
Published: 2025-02-03
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.5.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/bulk-editor/vulnerability/wordpress-wolf-plugin-1-0-8-5-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-24620
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hkharpreetkumar1 AIO Shortcodes aio-shortcodes allows Stored XSS.This issue affects AIO Shortcodes: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/aio-shortcodes/vulnerability/wordpress-aio-shortcodes-plugin-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24629
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gf-excel-import/vulnerability/wordpress-import-excel-to-gravity-forms-plugin-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24630
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sikshya/vulnerability/wordpress-sikshya-lms-plugin-0-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24631
Published: 2025-02-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24639
Published: 2025-02-03
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/korea-for-woocommerce/vulnerability/wordpress-korea-for-woocommerce-plugin-1-1-11-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-24642
Published: 2025-02-03
Description: Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Setup Default Featured Image: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/setup-default-feature-image/vulnerability/wordpress-setup-default-featured-image-plugin-1-2-broken-access-control-vulnerability?_s_id=cve