deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24594
Published: 2025-01-24
Description: Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/linet-erp-woocommerce-integration/vulnerability/wordpress-linet-erp-woocommerce-integration-plugin-3-5-7-csrf-to-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24595
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/all-embed-addons-for-elementor/vulnerability/wordpress-all-embed-elementor-addons-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24596
Published: 2025-01-24
Description: Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wc-product-table-lite/vulnerability/wordpress-woocommerce-product-table-lite-plugin-3-8-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24604
Published: 2025-01-24
Description: Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/v-form/vulnerability/wordpress-lifetime-free-drag-drop-contact-form-builder-for-wordpress-vform-plugin-3-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24610
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/restrict-anonymous-access/vulnerability/wordpress-restrict-anonymous-access-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24611
Published: 2025-01-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp-ultimate-exporter/vulnerability/wordpress-export-all-posts-products-orders-refunds-users-plugin-2-9-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2025-24613
Published: 2025-01-24
Description: Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/thoughtful-comments/vulnerability/wordpress-fv-thoughtful-comments-plugin-0-3-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24618
Published: 2025-01-24
Description: Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24622
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager job-board-manager allows Cross Site Request Forgery.This issue affects Job Board Manager: from n/a through <= 2.1.59.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-59-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24623
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/really-simple-ssl/vulnerability/wordpress-really-simple-security-plugin-9-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24625
Published: 2025-01-24
Description: Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/taxonomy-discounts-woocommerce/vulnerability/wordpress-taxonomy-term-and-role-based-discounts-for-woocommerce-plugin-5-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24627
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blur-text/vulnerability/wordpress-blur-text-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24633
Published: 2025-01-24
Description: Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/build-private-store-for-woocommerce/vulnerability/wordpress-build-private-store-for-woocommerce-plugin-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24634
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/orbisius-simple-notice/vulnerability/wordpress-orbisius-simple-notice-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24636
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rick Laymance MachForm Shortcode machform-shortcode allows Stored XSS.This issue affects MachForm Shortcode: from n/a through <= 1.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/machform-shortcode/vulnerability/wordpress-machform-shortcode-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24638
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/create-with-code/vulnerability/wordpress-create-with-code-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24644
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through <= 4.7.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/print-invoices-packing-slip-labels-for-woocommerce/vulnerability/wordpress-woocommerce-pdf-invoices-plugin-4-7-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24647
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in datafeedr WooCommerce Cloak Affiliate Links woocommerce-cloak-affiliate-links allows Cross Site Request Forgery.This issue affects WooCommerce Cloak Affiliate Links: from n/a through <= 1.0.35.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-cloak-affiliate-links/vulnerability/wordpress-woocommerce-cloak-affiliate-links-plugin-1-0-35-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24649
Published: 2025-01-24
Description: Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements/vulnerability/wordpress-admin-and-site-enhancements-ase-plugin-7-6-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24650
Published: 2025-01-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-15-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-24652
Published: 2025-01-24
Description: Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/local-sync/vulnerability/wordpress-wp-duplicate-plugin-1-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24657
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlist allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 2.1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wt-woocommerce-wishlist/vulnerability/wordpress-wishlist-for-woocommerce-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24658
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Auction Nudge – Your eBay on Your Site auction-nudge allows Stored XSS.This issue affects Auction Nudge – Your eBay on Your Site: from n/a through <= 7.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/auction-nudge/vulnerability/wordpress-auction-nudge-your-ebay-on-your-site-plugin-7-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24659
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell-digital-products-securely-plugin-5-9-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24663
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/simple-download-monitor/vulnerability/wordpress-simple-download-monitor-plugin-3-9-25-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24666
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Stored XSS.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through <= 1.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hyve-lite/vulnerability/wordpress-hyve-lite-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24668
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-product-addon/vulnerability/wordpress-ppom-for-woocommerce-plugin-33-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24669
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/serped-net/vulnerability/wordpress-serped-net-plugin-4-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24672
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cp-easy-form-builder/vulnerability/wordpress-form-builder-cp-plugin-1-2-41-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24673
Published: 2025-01-24
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/ketchup-shortcodes-pack/vulnerability/wordpress-ketchup-shortcodes-plugin-0-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24674
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denis Cherniatev ShMapper by Teplitsa shmapper-by-teplitsa allows Stored XSS.This issue affects ShMapper by Teplitsa: from n/a through <= 1.5.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shmapper-by-teplitsa/vulnerability/wordpress-shmapper-by-teplitsa-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24675
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24678
Published: 2025-01-24
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/listamester/vulnerability/wordpress-listamester-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24679
Published: 2025-01-24
Description: Missing Authorization vulnerability in webraketen Internal Links Manager seo-automated-link-building allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Links Manager: from n/a through <= 2.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/seo-automated-link-building/vulnerability/wordpress-internal-links-manager-plugin-2-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24681
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate allows Stored XSS.This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through <= 1.10.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-carousel-slider-and-grid-ultimate/vulnerability/wordpress-product-carousel-slider-grid-ultimate-for-woocommerce-plugin-1-10-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24682
Published: 2025-01-24
Description: Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/super-block-slider/vulnerability/wordpress-super-block-slider-plugin-2-7-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24683
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rsvp/vulnerability/wordpress-rsvp-and-event-management-plugin-2-7-14-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24687
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lars Wallenborn Show/Hide Shortcode showhide-shortcode allows Stored XSS.This issue affects Show/Hide Shortcode: from n/a through <= 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/showhide-shortcode/vulnerability/wordpress-show-hide-shortcode-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24691
Published: 2025-01-24
Description: Missing Authorization vulnerability in ctltwp People Lists people-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects People Lists: from n/a through <= 1.3.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/people-lists/vulnerability/wordpress-people-lists-plugin-1-3-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24693
Published: 2025-01-24
Description: Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/advanced-notifications/vulnerability/wordpress-advanced-notifications-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24695
Published: 2025-01-24
Description: Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/extensions-for-cf7/vulnerability/wordpress-extensions-for-cf7-plugin-3-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-24696
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shafaet Alam Attire Blocks attire-blocks allows Cross Site Request Forgery.This issue affects Attire Blocks: from n/a through <= 1.9.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/attire-blocks/vulnerability/wordpress-gutenberg-blocks-and-page-layouts-plugin-1-9-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24698
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in g5theme Essential Real Estate essential-real-estate allows Cross Site Request Forgery.This issue affects Essential Real Estate: from n/a through <= 5.1.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/essential-real-estate/vulnerability/wordpress-essential-real-estate-plugin-5-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24701
Published: 2025-01-24
Description: Server-Side Request Forgery (SSRF) vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through <= 1.3.2.9.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-3-2-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-24702
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xagio SEO Xagio SEO xagio-seo allows Stored XSS.This issue affects Xagio SEO: from n/a through <= 7.0.0.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xagio-seo/vulnerability/wordpress-xagio-seo-plugin-7-0-0-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24703
Published: 2025-01-24
Description: Server-Side Request Forgery (SSRF) vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through <= 3.0.33.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/simple-comment-editing/vulnerability/wordpress-comment-edit-core-simple-comment-editing-plugin-3-0-33-server-side-request-forgery-ssrf-vulnerability?_s_id=cve