deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-36529
Published: 2025-06-27
Description: An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who is logging in to the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU93396297/; https://www.tbeye.com/topics/ahd/
CVE: CVE-2025-41418
Published: 2025-06-27
Description: Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated abnormally by processing  a specially crafted request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://jvn.jp/en/vu/JVNVU93396297/; https://www.tbeye.com/topics/ahd/
CVE: CVE-2025-5035
Published: 2025-06-27
Description: The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5dca30af-4624-4a71-93be-00fa8dc00c97/; https://wpscan.com/vulnerability/5dca30af-4624-4a71-93be-00fa8dc00c97/
CVE: CVE-2025-5093
Published: 2025-06-27
Description: The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/; https://wpscan.com/vulnerability/1862b4a6-5570-48a4-9b09-f9659eb0e9e3/
CVE: CVE-2025-5194
Published: 2025-06-27
Description: The WP Map Block  WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f90b7ad6-e2a2-4833-a390-a78c64dc2382/; https://wpscan.com/vulnerability/f90b7ad6-e2a2-4833-a390-a78c64dc2382/
CVE: CVE-2025-5526
Published: 2025-06-27
Description: The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/10196cd3-5bf7-4e40-a4f7-4ff2d34d516d/; https://wpscan.com/vulnerability/10196cd3-5bf7-4e40-a4f7-4ff2d34d516d/
CVE: CVE-2025-4587
Published: 2025-06-27
Description: The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ab-testing-for-wp/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcf401a-3b91-4b55-b6b1-a132ec195607?source=cve
CVE: CVE-2025-5306
Published: 2025-06-27
Description: Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2025-5936
Published: 2025-06-27
Description: The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/vr-calendar-sync/trunk/Admin/Classes/VRCalendarAdmin.class.php#L98; https://www.wordfence.com/threat-intel/vulnerabilities/id/57dbafe8-dcb3-4ac9-ad5e-76baf1963850?source=cve
CVE: CVE-2025-5940
Published: 2025-06-27
Description: The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/osomblocks/trunk/blocks/cpt-list/index.php#L171; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3320673%40osomblocks&new=3320673%40osomblocks&sfp_email=&sfph_mail=; https://wordpress.org/plugins/osomblocks/#developers
CVE: CVE-2025-6550
Published: 2025-06-27
Description: The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25; https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31; https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57
CVE: CVE-2025-6688
Published: 2025-06-27
Description: The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/changeset/3318371/simple-payment/tags/2.3.9/simple-payment-plugin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4e2f87-e3ad-4f1b-b647-f5e5a49f691b?source=cve
CVE: CVE-2025-6689
Published: 2025-06-27
Description: The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/fl3r-accessibility-suite/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/33f673b5-2bcb-4591-b589-4d7230b5c2e7?source=cve
CVE: CVE-2024-12827
Published: 2025-06-27
Description: The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132; https://www.wordfence.com/threat-intel/vulnerabilities/id/51fc7d47-2a0f-4713-9859-120321aa32dc?source=cve
CVE: CVE-2025-2940
Published: 2025-06-27
Description: The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.18/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L268; https://plugins.trac.wordpress.org/browser/ninja-tables/tags/5.0.19/vendor/wpfluent/framework/src/WPFluent/Http/Client.php; https://plugins.trac.wordpress.org/browser/ninja-tables/trunk/vendor/wpfluent/framework/src/WPFluent/Http/Client.php#L268
CVE: CVE-2025-5398
Published: 2025-06-27
Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.10.1/assets/js/min/front-end.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3317181%40ninja-forms&new=3317181%40ninja-forms&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/92d106c6-a910-4f41-94d1-59f6b7f3aeb0?source=cve
CVE: CVE-2025-6761
Published: 2025-06-27
Description: A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 Action.class of the component Freemarker Engine. The manipulation leads to improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor explains, that in the fixed release "Freemarker is set to 'ALLOWS_NOTHING_RESOLVER' to not parse any classes."
CVSS Score: 7.3 (HIGH)
CWE: CWE-791, CWE-1336
References: https://vip.kingdee.com/link/s/ZlWX7; https://vip.kingdee.com/school/detail/[PII_REDACTED]45944320; https://vuldb.com/?ctiid.314072
CVE: CVE-2023-25998
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/samex/vulnerability/wordpress-samex-clean-minimal-shop-woocommerce-wordpress-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-23967
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpopal GG Bought Together for WooCommerce gg-bought-together allows SQL Injection.This issue affects GG Bought Together for WooCommerce: from n/a through <= 1.0.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gg-bought-together/vulnerability/wordpress-gg-bought-together-for-woocommerce-1-0-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-23973
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugudlabs SpecFit-Virtual Try On Woocommerce try-on-for-woocommerce allows Stored XSS.This issue affects SpecFit-Virtual Try On Woocommerce: from n/a through <= 8.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/try-on-for-woocommerce/vulnerability/wordpress-specfit-virtual-try-on-woocommerce-7-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24760
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Sofass sofass allows PHP Local File Inclusion.This issue affects Sofass: from n/a through <= 1.3.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/sofass/vulnerability/wordpress-sofass-1-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24765
Published: 2025-06-27
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow image-shadow allows Path Traversal.This issue affects Image Shadow: from n/a through <= 1.1.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/image-shadow/vulnerability/wordpress-image-shadow-1-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-24769
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny bw-zenny allows PHP Local File Inclusion.This issue affects Zenny: from n/a through <= 1.7.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/bw-zenny/vulnerability/wordpress-zenny-1-7-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24774
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows Reflected XSS.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcrm/vulnerability/wordpress-wpcrm-crm-for-contact-form-cf7-woocommerce-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25171
Published: 2025-06-27
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/smartpay/vulnerability/wordpress-wp-smartpay-plugin-2-7-13-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2025-25173
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fastbook-responsive-appointment-booking-and-scheduling-system/vulnerability/wordpress-fastbook-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27361
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thhake Photo Express for Google photo-express-for-google allows Reflected XSS.This issue affects Photo Express for Google: from n/a through <= 0.3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/photo-express-for-google/vulnerability/wordpress-photo-express-for-google-plugin-0-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28946
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore bw-printxtore allows PHP Local File Inclusion.This issue affects PrintXtore: from n/a through < 1.7.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/bw-printxtore/vulnerability/wordpress-printxtore-1-7-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28947
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme MBStore - Digital WooCommerce WordPress Theme mbstore allows PHP Local File Inclusion.This issue affects MBStore - Digital WooCommerce WordPress Theme: from n/a through <= 2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/mbstore/vulnerability/wordpress-mbstore-digital-woocommerce-wordpress-theme-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28956
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp backwp allows Reflected XSS.This issue affects Backwp: from n/a through <= 2.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/backwp/vulnerability/wordpress-backwp-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28960
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regibaer Evangelische Termine evangtermine allows Reflected XSS.This issue affects Evangelische Termine: from n/a through <= 3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/evangtermine/vulnerability/wordpress-evangelische-termine-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28970
Published: 2025-06-27
Description: Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through <= 5.1.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-optimize-by-xtraffic/vulnerability/wordpress-wp-optimize-by-xtraffic-5-1-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28988
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Reflected XSS.This issue affects WP Front User Submit / Front Editor: from n/a through <= 4.9.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/front-editor/vulnerability/wordpress-wp-front-user-submit-front-editor-plugin-4-9-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28990
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Vicky snsvicky allows PHP Local File Inclusion.This issue affects SNS Vicky: from n/a through <= 3.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snsvicky/vulnerability/wordpress-sns-vicky-3-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28993
Published: 2025-06-27
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through <= 0.1.4.
CVSS Score: 8.6 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/content-no-cache/vulnerability/wordpress-content-no-cache-plugin-0-1-3-arbitrary-function-call-vulnerability?_s_id=cve
CVE: CVE-2025-28998
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in serpednet SERPed.net serped-net allows PHP Local File Inclusion.This issue affects SERPed.net: from n/a through <= 4.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/serped-net/vulnerability/wordpress-serped-net-4-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-30972
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan Woocommerce Line Notify woo-line-notify allows Stored XSS.This issue affects Woocommerce Line Notify: from n/a through <= 1.1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-line-notify/vulnerability/wordpress-woocommerce-line-notify-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30992
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through <= 2.6.33.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/puca/vulnerability/wordpress-puca-2-6-33-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31067
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS. This issue affects Seven Stars: from n/a through 1.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/sevenstars/vulnerability/wordpress-seven-stars-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31428
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through <= 2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/hydro/vulnerability/wordpress-hydro-theme-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32281
Published: 2025-06-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a through <= 1.2.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/darkmysite/vulnerability/wordpress-darkmysite-advanced-dark-mode-plugin-for-wordpress-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32298
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers ctuser allows PHP Local File Inclusion.This issue affects CTUsers: from n/a through <= 1.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ctuser/vulnerability/wordpress-ctusers-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39474
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through <= 3.1.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/amely/vulnerability/wordpress-amely-theme-3-1-4-sql-injection-vulnerability?_s_id=cve