deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1771
Published: 2025-03-15
Description: The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://travelerwp.com/traveler-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=cve
CVE: CVE-2025-1773
Published: 2025-03-15
Description: The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://travelerwp.com/traveler-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/46c9dae7-d811-4b59-94c1-71a83652a14d?source=cve
CVE: CVE-2025-30066
Published: 2025-03-15
Description: tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
CVSS Score: 8.6 (HIGH)
CWE: CWE-506
References: https://blog.gitguardian.com/compromised-tj-actions/; https://github.com/chains-project/maven-lockfile/pull/1111; https://github.com/espressif/arduino-esp32/issues/11127
CVE: CVE-2019-25222
Published: 2025-03-15
Description: The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/tags/1.0.4/wp-responsive-images-thumbnail-slider.php#L1326; https://plugins.trac.wordpress.org/browser/wp-responsive-thumbnail-slider/tags/1.0.5/wp-responsive-images-thumbnail-slider.php; https://wordpress.org/plugins/wp-responsive-thumbnail-slider
CVE: CVE-2025-2157
Published: 2025-03-15
Description: A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://access.redhat.com/security/cve/CVE-2025-2157; https://bugzilla.redhat.com/show_bug.cgi?id=2351092
CVE: CVE-2025-2325
Published: 2025-03-15
Description: The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3251086%40wp-test-email&new=3251086%40wp-test-email&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a9ff8-ed93-4de9-ba49-730b2253c6a4?source=cve
CVE: CVE-2025-1057
Published: 2025-03-15
Description: A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-704
References: https://access.redhat.com/security/cve/CVE-2025-1057; https://bugzilla.redhat.com/show_bug.cgi?id=2343894
CVE: CVE-2025-1530
Published: 2025-03-15
Description: The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php; https://plugins.trac.wordpress.org/changeset/3251202/; https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php
CVE: CVE-2025-2025
Published: 2025-03-15
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/reports/reports.php#L304; https://plugins.trac.wordpress.org/changeset/3252319/; https://wordpress.org/plugins/give/#description
CVE: CVE-2025-2321
Published: 2025-03-15
Description: A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-840
References: https://vuldb.com/?ctiid.299750; https://vuldb.com/?id.299750; https://vuldb.com/?submit.505690
CVE: CVE-2025-2333
Published: 2025-03-15
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-2322
Published: 2025-03-15
Description: A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-259, CWE-798
References: https://vuldb.com/?ctiid.299751; https://vuldb.com/?id.299751; https://vuldb.com/?submit.505694
CVE: CVE-2025-2323
Published: 2025-03-15
Description: A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQuestionCou of the file /api/mjkj-chat/chat/mng/update/questionCou of the component Number of Question Handler. The manipulation leads to enforcement of behavioral workflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840, CWE-841
References: https://vuldb.com/?ctiid.299752; https://vuldb.com/?id.299752; https://vuldb.com/?submit.505695
CVE: CVE-2025-25225
Published: 2025-03-15
Description: A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25225; https://www.hikashop.com/
CVE: CVE-2025-23744
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through <= 1.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/random-posts-mp3-player-sharebutton/vulnerability/wordpress-random-posts-mp3-player-sharebutton-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26548
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/random-image-selector/vulnerability/wordpress-random-image-selector-plugin-1-5-6-reflected-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2025-26553
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin: from n/a through <= 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-pre-order/vulnerability/wordpress-pre-order-addon-for-woocommerce-plugin-1-0-7-reflected-cross-site-scripting?_s_id=cve
CVE: CVE-2025-26554
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-discord-post/vulnerability/wordpress-wp-discord-post-plugin-2-1-0-reflectef-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26555
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/debug-bar-extender/vulnerability/wordpress-debug-bar-extender-plugin-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26556
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpantiddos/vulnerability/wordpress-wp-antiddos-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26875
Published: 2025-03-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/different-shipping-and-billing-address-for-woocommerce/vulnerability/wordpress-multiple-shipping-and-billing-address-for-woocommerce-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26886
Published: 2025-03-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through <= 4.7.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/publishpress-authors/vulnerability/wordpress-publishpress-authors-plugin-4-7-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26895
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows DOM-Based XSS.This issue affects m1.DownloadList: from n/a through <= 0.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26899
Published: 2025-03-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross Site Request Forgery.This issue affects Recapture for WooCommerce: from n/a through <= 1.0.43.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/recapture-for-woocommerce/vulnerability/wordpress-recapture-for-woocommerce-plugin-1-0-43-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-26921
Published: 2025-03-15
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-2-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26924
Published: 2025-03-15
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra: from n/a through <= 3.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/ohio-extra/vulnerability/wordpress-ohio-theme-extra-plugin-3-4-7-shortcode-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26940
Published: 2025-03-15
Description: Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-35
References: https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-2-path-traversal-to-non-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-26961
Published: 2025-03-15
Description: Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through <= 1.70.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26969
Published: 2025-03-15
Description: Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
CVSS Score: 8.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-5-subscriber-site-wide-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26972
Published: 2025-03-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26976
Published: 2025-03-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26978
Published: 2025-03-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/fs-poster/vulnerability/wordpress-fs-poster-plugin-6-5-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-27281
Published: 2025-03-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injection.This issue affects All In Menu: from n/a through <= 1.1.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/all-in-menu/vulnerability/wordpress-all-in-menu-plugin-1-1-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-0524
Published: 2025-03-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-2334
Published: 2025-03-15
Description: A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://vuldb.com/?ctiid.299799; https://vuldb.com/?id.299799; https://vuldb.com/?submit.505688
CVE: CVE-2022-49737
Published: 2025-03-16
Description: In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.
CVSS Score: 7.7 (HIGH)
CWE: CWE-413
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1081338;filename=dix-Hold-input-lock-for-AttachDevice.patch;msg=5; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338; https://gitlab.freedesktop.org/xorg/xserver/-/commit/dc7cb45482cea6ccec22d117ca0b489500b4d0a0
CVE: CVE-2025-2335
Published: 2025-03-16
Description: A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yago3008/cves; https://vuldb.com/?ctiid.299800; https://vuldb.com/?id.299800
CVE: CVE-2025-30074
Published: 2025-03-16
Description: Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://kb.parallels.com/en/130944
CVE: CVE-2025-30076
Published: 2025-03-16
Description: Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.
CVSS Score: 7.7 (HIGH)
CWE: CWE-78
References: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170; https://github.com/gl0wyy/koha-task-scheduler-rce; https://github.com/gl0wyy/koha-task-scheduler-rce
CVE: CVE-2025-30077
Published: 2025-03-16
Description: Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-129
References: https://github.com/onosproject/onos-lib-go/issues/295; https://github.com/onosproject/onos-lib-go/issues/295
CVE: CVE-2024-58103
Published: 2025-03-16
Description: Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-674
References: https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d; https://github.com/square/wire/compare/5.1.0...5.2.0
CVE: CVE-2025-24856
Published: 2025-03-16
Description: An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: (1) an attacker can anticipate the e-mail address of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's first OIDC login, and (3) the IDP returns an email field containing the e-mail address of the user,
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-348
References: https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3; https://typo3.org/security/advisory/typo3-ext-sa-2025-001
CVE: CVE-2024-13126
Published: 2025-03-16
Description: The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-552
References: https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803/
CVE: CVE-2024-13602
Published: 2025-03-16
Description: The Poll Maker  WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/05d5010b-94eb-4fd3-b962-e2a16c032b71/