deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6766
Published: 2025-06-27
Description: A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument officesName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sfturing/hosp_order/issues/108; https://vuldb.com/?ctiid.314080; https://vuldb.com/?id.314080
CVE: CVE-2025-6767
Published: 2025-06-27
Description: A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/sfturing/hosp_order/issues/109; https://vuldb.com/?ctiid.314081; https://vuldb.com/?id.314081
CVE: CVE-2025-36595
Published: 2025-06-27
Description: Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-96
References: https://www.dell.com/support/kbdoc/en-us/000337554/dsa-2025-235-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-and-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilit
CVE: CVE-2025-44163
Published: 2025-06-27
Description: RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-23
References: https://gist.github.com/YichaoXu/3694f039a3d1b973efd068e4dc662a41; https://github.com/RaspAP/raspap-webgui/blob/125ae7a39ad7c9a71250d3b3e349fd767687ff8d/ajax/networking/get_wgkey.php#L9
CVE: CVE-2025-45729
Published: 2025-06-27
Description: D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://www.kdev.site/2025/04/02/d-link-823_pro-unauthorized-telnet-access/
CVE: CVE-2025-46415
Published: 2025-06-27
Description: A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS Score: 3.2 (LOW)
CWE: CWE-367
References: https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/; https://labs.snyk.io
CVE: CVE-2025-46416
Published: 2025-06-27
Description: The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS Score: 2.9 (LOW)
CWE: CWE-282
References: https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/; https://labs.snyk.io
CVE: CVE-2025-50528
Published: 2025-06-27
Description: A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://github.com/pfwqdxwdd/cve/blob/main/1.md
CVE: CVE-2025-52991
Published: 2025-06-27
Description: The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS Score: 3.2 (LOW)
CWE: CWE-276
References: https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/; https://labs.snyk.io
CVE: CVE-2025-52992
Published: 2025-06-27
Description: The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS Score: 3.2 (LOW)
CWE: CWE-732
References: https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/; https://labs.snyk.io
CVE: CVE-2025-52993
Published: 2025-06-27
Description: A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-362
References: https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/; https://labs.snyk.io
CVE: CVE-2025-53193
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects Burst Statistics: from n/a through <= 2.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/burst-statistics/vulnerability/wordpress-burst-statistics-plugin-2-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53197
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cookiebot/vulnerability/wordpress-cookiebot-plugin-4-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53199
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through <= 1.6.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-slider-for-elementor/vulnerability/wordpress-ht-slider-for-elementor-plugin-1-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53200
Published: 2025-06-27
Description: Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 6.7.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-chatbot-plugin-6-7-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53202
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows DOM-Based XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-block-editor-addons/vulnerability/wordpress-responsive-blocks-plugin-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53203
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-pdf-invoice-builder/vulnerability/wordpress-woocommerce-pdf-invoice-builder-plugin-1-2-148-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53206
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-mega-for-wpbakery/vulnerability/wordpress-ht-mega-absolute-addons-for-wpbakery-page-builder-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53211
Published: 2025-06-27
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/audio-editor-recorder/vulnerability/wordpress-audio-editor-recorder-plugin-2-2-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53253
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects WP Edit: from n/a through <= 4.0.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-edit/vulnerability/wordpress-wp-edit-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53254
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cyrlitera/vulnerability/wordpress-cyrlitera-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53255
Published: 2025-06-27
Description: Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through <= 2.13.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hurrytimer/vulnerability/wordpress-hurrytimer-plugin-2-13-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53256
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows SQL Injection.This issue affects YaySMTP: from n/a through <= 2.6.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/yaysmtp/vulnerability/wordpress-yaysmtp-plugin-6-8-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53257
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through <= 1.23.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/grand-media/vulnerability/wordpress-gmedia-photo-gallery-plugin-1-23-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53258
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wow-Company Hover Effects hover-effects allows SQL Injection.This issue affects Hover Effects: from n/a through <= 2.1.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/hover-effects/vulnerability/wordpress-hover-effects-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53259
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53260
Published: 2025-06-27
Description: Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a through <= 7.5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/file-manager-plugin-for-wordpress/vulnerability/wordpress-file-manager-plugin-for-wordpress-plugin-7-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-53261
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-youtube-live/vulnerability/wordpress-wp-youtube-live-plugin-1-10-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53262
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through <= 1.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/writesonic/vulnerability/wordpress-writesonic-plugin-1-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53263
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/gf-google-address-autocomplete/vulnerability/wordpress-address-autocomplete-via-google-for-gravity-forms-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53264
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/onet-regenerate-thumbnails/vulnerability/wordpress-onet-regenerate-thumbnails-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53265
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <= 1.1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/virusdie/vulnerability/wordpress-virusdie-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53266
Published: 2025-06-27
Description: Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cron-logger/vulnerability/wordpress-cron-logger-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53267
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.This issue affects Hide Admin Bar From Front End: from n/a through <= 1.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hide-admin-bar-from-front-end/vulnerability/wordpress-hide-admin-bar-from-front-end-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53268
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/import-external-attachments/vulnerability/wordpress-import-external-attachments-plugin-1-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53269
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through <= 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/my-wp-brand/vulnerability/wordpress-my-wp-brand-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53270
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-sticky-sidebar/vulnerability/wordpress-cta-plugin-1-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53271
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Anton Bond Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce allows Stored XSS.This issue affects Additional Order Filters for WooCommerce: from n/a through <= 1.22.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/additional-order-filters-for-woocommerce/vulnerability/wordpress-additional-order-filters-for-woocommerce-plugin-1-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53272
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from n/a through <= 1.9.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/image-cleanup/vulnerability/wordpress-image-cleanup-plugin-1-9-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53273
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: from n/a through <= 2.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/slick-engagement/vulnerability/wordpress-slickstream-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53274
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through <= 1.7.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-permalink-translator/vulnerability/wordpress-wp-permalink-translator-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53275
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue affects Leyka: from n/a through <= 3.32.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leyka/vulnerability/wordpress-leyka-plugin-3-31-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53276
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/omnipress/vulnerability/wordpress-omnipress-plugin-1-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53277
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Infigo Software IS-theme-companion weblizar-companion allows Object Injection.This issue affects IS-theme-companion: from n/a through <= 1.59.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/weblizar-companion/vulnerability/wordpress-is-theme-companion-plugin-1-57-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53278
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpadcenter/vulnerability/wordpress-wp-adcenter-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53279
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/popup-addon-for-ninja-forms/vulnerability/wordpress-popup-addon-for-ninja-forms-plugin-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53280
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/football-pool/vulnerability/wordpress-football-pool-plugin-2-12-5-cross-site-scripting-xss-vulnerability?_s_id=cve