deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48265
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through <= 1.0.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ymm-search/vulnerability/wordpress-year-make-model-search-for-woocommerce-plugin-1-0-11-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-48266
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Stored XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.6.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-1-0-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48268
Published: 2025-05-19
Description: Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through <= 1.2.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bot-for-telegram-on-woocommerce/vulnerability/wordpress-bot-for-telegram-on-woocommerce-1-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48269
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpadverts/vulnerability/wordpress-wpadverts-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48270
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows DOM-Based XSS.This issue affects SKT Blocks: from n/a through <= 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-blocks/vulnerability/wordpress-skt-blocks-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48272
Published: 2025-05-19
Description: Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.3.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-2-3-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-48276
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through <= 45.11.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-45-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48277
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.74.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cost-calculator-builder/vulnerability/wordpress-cost-calculator-builder-3-2-74-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48278
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker  rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.5.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rsvpmaker/vulnerability/wordpress-rsvpmarker-11-5-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48280
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows Blind SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.1.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/automatorwp/vulnerability/wordpress-automatorwp-5-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48282
Published: 2025-05-19
Description: Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/majestic-support/vulnerability/wordpress-majestic-support-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48284
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Cross Site Request Forgery.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.40.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-for-japan/vulnerability/wordpress-japanized-for-woocommerce-2-6-40-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48285
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.61.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/falang/vulnerability/wordpress-falang-multilanguage-1-3-61-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48288
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48341
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through <= 1.15.33.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/form-maker/vulnerability/wordpress-form-maker-by-10web-1-15-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48342
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in RedefiningTheWeb Dynamic Pricing & Discounts Lite for WooCommerce woo-dynamic-pricing-discounts-lite allows Cross Site Request Forgery.This issue affects Dynamic Pricing & Discounts Lite for WooCommerce: from n/a through <= 2.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-dynamic-pricing-discounts-lite/vulnerability/wordpress-dynamic-pricing-discounts-lite-for-woocommerce-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48344
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in ed4becky Rootspersona rootspersona allows Cross Site Request Forgery.This issue affects Rootspersona: from n/a through <= 3.7.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rootspersona/vulnerability/wordpress-rootspersona-3-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48346
Published: 2025-05-19
Description: Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/embed-and-integrate-etsy-shop/vulnerability/wordpress-embed-and-integrate-etsy-shop-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-4936
Published: 2025-05-19
Description: A vulnerability was found in projectworlds Online Food Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin-page.php. The manipulation of the argument 1_price leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sknadklasdls/CVE/issues/3; https://vuldb.com/?ctiid.309498; https://vuldb.com/?id.309498
CVE: CVE-2025-4937
Published: 2025-05-19
Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Angel12345623/CVE/blob/main/CVE_3.md; https://vuldb.com/?ctiid.309499; https://vuldb.com/?id.309499
CVE: CVE-2024-33939
Published: 2025-05-19
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/learning-management-system/vulnerability/wordpress-lms-by-masteriyo-plugin-1-7-3-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-22678
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mythemes my white allows Reflected XSS.This issue affects my white: from n/a through 2.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/my-white/vulnerability/wordpress-my-white-theme-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22687
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asmedia Tuaug4 allows Reflected XSS.This issue affects Tuaug4: from n/a through 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/tuaug4/vulnerability/wordpress-tuaug4-theme-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22789
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks polka dots allows Reflected XSS.This issue affects polka dots: from n/a through 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/polka-dots/vulnerability/wordpress-polka-dots-theme-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22790
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asmedia allows Reflected XSS.This issue affects moseter: from n/a through 1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/moseter/vulnerability/wordpress-moseter-theme-1-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22791
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twh offset writing allows Reflected XSS.This issue affects offset writing: from n/a through 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/offset-writing/vulnerability/wordpress-offset-writing-theme-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22792
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/js-o3-lite/vulnerability/wordpress-js-o3-lite-theme-1-5-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23979
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Flashy: from n/a through 1.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/flashy/vulnerability/wordpress-flashy-theme-1-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23981
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue affects CarZine: from n/a through 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/carzine/vulnerability/wordpress-carzine-theme-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23983
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tijaji Tijaji tijaji allows Reflected XSS.This issue affects Tijaji: from n/a through <= 1.43.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/tijaji/vulnerability/wordpress-tijaji-theme-1-43-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23986
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks Tiki Time allows Reflected XSS.This issue affects Tiki Time: from n/a through 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/tiki-time/vulnerability/wordpress-tiki-time-theme-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23988
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/ghostwriter/vulnerability/wordpress-ghostwriter-theme-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24183
Published: 2025-05-19
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local user may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.apple.com/en-us/122068; https://support.apple.com/en-us/122069; https://support.apple.com/en-us/122070
CVE: CVE-2025-24184
Published: 2025-05-19
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/122066; https://support.apple.com/en-us/122067; https://support.apple.com/en-us/122068
CVE: CVE-2025-24189
Published: 2025-05-19
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122066; https://support.apple.com/en-us/122068; https://support.apple.com/en-us/122071
CVE: CVE-2025-26621
Published: 2025-05-19
Description: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94, CWE-1321
References: https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-gq63-jm3h-374p; https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm
CVE: CVE-2025-31185
Published: 2025-05-19
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3. Photos in the Hidden Photos Album may be viewed without authentication.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/122066
CVE: CVE-2025-31262
Published: 2025-05-19
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://support.apple.com/en-us/122066; https://support.apple.com/en-us/122068; https://support.apple.com/en-us/122071
CVE: CVE-2025-32920
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ti-woocommerce-wishlist/vulnerability/wordpress-ti-woocommerce-wishlist-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-4876
Published: 2025-05-19
Description: ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained the key can be used to decrypt CSV input files used for authenticated network scanning.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-321
References: https://github.com/packetlabs/vulnerability-advisory/blob/main/Disclosures/PL-2025-11315/README.md
CVE: CVE-2025-4938
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registererms.php. The manipulation of the argument Email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/WuYanneko/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.309500
CVE: CVE-2025-4939
Published: 2025-05-19
Description: A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the file /admin/new-ccapplication.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/GIRISH05/credit-card-application-management-system-using-php-and-mysql/blob/main/Stored%20Cross-Site%20Scripting%20(XSS).md; https://phpgurukul.com/; https://vuldb.com/?ctiid.309502
CVE: CVE-2025-4948
Published: 2025-05-19
Description: A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://access.redhat.com/errata/RHSA-2025:21657; https://access.redhat.com/errata/RHSA-2025:8126; https://access.redhat.com/errata/RHSA-2025:8128
CVE: CVE-2025-26867
Published: 2025-05-19
Description: Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/bulk/vulnerability/wordpress-bulk-theme-1-0-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26920
Published: 2025-05-19
Description: Missing Authorization vulnerability in pressmaximum Customify customify-theme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customify: from n/a through <= 0.4.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/customify-theme/vulnerability/wordpress-customify-theme-0-4-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39351
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Cross Site Request Forgery.This issue affects Grand Restaurant: from n/a through <= 7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39353
Published: 2025-05-19
Description: Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-wordpress-theme-7-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39364
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginEver Product Category Slider for WooCommerce woo-category-slider-by-pluginever allows PHP Local File Inclusion.This issue affects Product Category Slider for WooCommerce: from n/a through <= 4.3.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/woo-category-slider-by-pluginever/vulnerability/wordpress-product-category-slider-for-woocommerce-plugin-4-3-4-local-file-inclusion-vulnerability?_s_id=cve