deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-64433
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM. Specifically, if a malicious user has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within the virt-launcher pod's file system. Since libvirt can treat regular files as block devices, any file on the pod's file system that is symlinked in this way can be mounted into the VM and subsequently read. Although a security mechanism exists where VMs are executed as an unprivileged user with UID 107 inside the virt-launcher container, limiting the scope of accessible resources, this restriction is bypassed due to a second vulnerability. The latter causes the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. As a result, an attacker can gain access to and read arbitrary files located within the virt-launcher pod's file system or on a mounted PVC from within the guest VM. This vulnerability is fixed in 1.5.3 and 1.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/kubevirt/kubevirt/commit/09eafa068ec01eca0e96ebafeeb9522a878dbf64; https://github.com/kubevirt/kubevirt/commit/9dc798cb1efe924a9a2b97b6e016452dec5e3849; https://github.com/kubevirt/kubevirt/commit/a81b27d4600cf654274dd[PII_REDACTED]2affdb08
CVE: CVE-2025-64434
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-287
References: https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a; https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b; https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
CVE: CVE-2025-64435
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703
References: https://github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba; https://github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9
CVE: CVE-2025-64436
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-276
References: https://github.com/kubevirt/kubevirt/security/advisories/GHSA-7xgm-5prm-v5gc
CVE: CVE-2025-64437
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59
References: https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afb; https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b; https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265
CVE: CVE-2025-12905
Published: 2025-11-08
Description: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/431309019
CVE: CVE-2025-12906
Published: 2025-11-08
Description: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/428455319
CVE: CVE-2025-12907
Published: 2025-11-08
Description: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/427367145
CVE: CVE-2025-12908
Published: 2025-11-08
Description: Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/421511847
CVE: CVE-2025-12909
Published: 2025-11-08
Description: Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/361116749
CVE: CVE-2025-12910
Published: 2025-11-08
Description: Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-1295
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/434977743
CVE: CVE-2025-12911
Published: 2025-11-08
Description: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/423670839
CVE: CVE-2025-64485
Published: 2025-11-08
Description: CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the user will be able to create files in the share directory of the import worker container, potentially filling up disk space. This issue is fixed in version 2.49.0.
CWE: CWE-22
References: https://github.com/cvat-ai/cvat/commit/cace877189528a7ed4a224476f4bc0bd5a21d40c; https://github.com/cvat-ai/cvat/security/advisories/GHSA-x396-w86c-gf6w
CVE: CVE-2025-64486
Published: 2025-11-08
Description: calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
CWE: CWE-73
References: https://github.com/kovidgoyal/calibre/commit/6f94bce214bf7d43c829804db3741afa5e83c0c5; https://github.com/kovidgoyal/calibre/security/advisories/GHSA-hpwq-c98h-xp8g
CVE: CVE-2025-64488
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131; https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5v53-v44q-ww2c
CVE: CVE-2025-64489
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an active session can continue to access the application and, critically, can self-reactivate their account. This undermines administrative controls and allows unauthorized persistence. This issue is fixed in versions 7.14.8 and 8.9.1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-269
References: https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131; https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-j6jg-9jj3-q2ph
CVE: CVE-2025-64490
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even when the related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Meetings, Calls) are explicitly set to Disabled/None in Role Management. This indicates inconsistent ACL/RBAC enforcement across modules and views, resulting in unauthorized data exposure and modification. This issue is fixed in versions 7.14.8 and 8.9.1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-863
References: https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-jh8v-wqgj-hhc2
CVE: CVE-2025-64491
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for example by altering the login form to send credentials to an attacker-controlled server. As a reflected XSS issue, exploitation requires the victim to open a crafted malicious link, which can be delivered via phishing, social media, or other communication channels. This issue is fixed in version 7.14.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d; https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-prfm-6667-x3mv
CVE: CVE-2025-64492
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-54m4-4p54-j8hp
CVE: CVE-2025-64493
Published: 2025-11-08
Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://docs.suitecrm.com/community/security-policy; https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-5gcj-mfqq-v8f7
CVE: CVE-2025-64494
Published: 2025-11-08
Description: Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-150
References: https://github.com/charmbracelet/soft-serve/commit/d9639320b8d0ccd76fe6836a042c042b0ebde549; https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fv2r-r8mp-pg48
CVE: CVE-2025-64495
Published: 2025-11-08
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant a payload that could be triggered by other users if they run the corresponding / command to insert the prompt. This issue is fixed in version 0.6.35.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348; https://github.com/open-webui/open-webui/commit/eb9c4c0e358c274aea35f21c2856c0a20051e5f1; https://github.com/open-webui/open-webui/security/advisories/GHSA-w7xj-8fx7-wfch
CVE: CVE-2025-64496
Published: 2025-11-08
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.
CVSS Score: 7.3 (HIGH)
CWE: CWE-95, CWE-501, CWE-829, CWE-830
References: https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca; https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx; https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx
CVE: CVE-2025-11452
Published: 2025-11-08
Description: The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/Asgaros/asgaros-forum/commit/41e499f26cb534c55587c35496e6f9056753b942; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388337%40asgaros-forum&new=3388337%40asgaros-forum&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/75d66a45-5bb9-4e82-acd5-e0b92e3870a9?source=cve
CVE: CVE-2025-12583
Published: 2025-11-08
Description: The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/simple-downloads-list/tags/1.5.0/admin/adminpanel_v3.php?rev=3388438; https://plugins.trac.wordpress.org/changeset?old_path=/simple-downloads-list/tags/1.4.3&new_path=/simple-downloads-list/tags/1.5.0&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/cbee3d3b-383b-48f5-be63-61cd692a18a0?source=cve
CVE: CVE-2025-11748
Published: 2025-11-08
Description: The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of the group_join function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to register for groups other than ones set in the shortcode.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/groups/trunk/lib/views/class-groups-shortcodes.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387846%40groups&new=3387846%40groups&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf?source=cve
CVE: CVE-2025-11972
Published: 2025-11-08
Description: The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/TaxoPress/TaxoPress/commit/fd[PII_REDACTED]9719b4304b336663e46f13f1533a; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=cve; https://github.com/TaxoPress/TaxoPress/issues/2827
CVE: CVE-2025-12000
Published: 2025-11-08
Description: The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.6.1/admin/modules/settings/class-wpfnl-settings.php#L591; https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.6.1/includes/core/logger/class-wpfnl-logger.php#L172; https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/admin/modules/settings/class-wpfnl-settings.php
CVE: CVE-2025-12042
Published: 2025-11-08
Description: The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389366%40course-booking-system&new=3389366%40course-booking-system&sfp_email=&sfph_mail=#file86; https://www.wordfence.com/threat-intel/vulnerabilities/id/38b2b477-5b8a-42c2-b346-57707d9a34a5?source=cve
CVE: CVE-2025-12064
Published: 2025-11-08
Description: The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3386972%40facebook-auto-publish&new=3386972%40facebook-auto-publish&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/32eb02b8-71cd-4cdb-aa9d-3fd1850fb126?source=cve
CVE: CVE-2025-12112
Published: 2025-11-08
Description: The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all versions up to, and including, 1.1.6 due to insufficient capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3387037%40insert-headers-and-footers-script&new=3387037%40insert-headers-and-footers-script&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f97ced40-c349-43b4-963f-2a49db4bbd4a?source=cve
CVE: CVE-2025-12125
Published: 2025-11-08
Description: The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3390481%40html-forms&new=3390481%40html-forms&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=cve