deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32283
Published: 2025-10-22
Description: Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/solar/vulnerability/wordpress-solar-energy-3-5-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32657
Published: 2025-10-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/testimonial-slider-showcase-pro/vulnerability/wordpress-testimonial-slider-and-showcase-pro-plugin-2-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39534
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/terms-dictionary/vulnerability/wordpress-terms-dictionary-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48082
Published: 2025-10-22
Description: Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Planner: from n/a through <= 1.8.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/progress-planner/vulnerability/wordpress-progress-planner-plugin-1-8-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-48091
Published: 2025-10-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/anycomment/vulnerability/wordpress-anycomment-plugin-0-3-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48092
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fix-multiple-redirects/vulnerability/wordpress-fix-multiple-redirects-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48093
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/password-only-login/vulnerability/wordpress-password-only-login-plugin-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48095
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48096
Published: 2025-10-22
Description: Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/custom-css-editor/vulnerability/wordpress-custom-css-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48097
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wsanalytics-google-analytics-and-dashboards/vulnerability/wordpress-wsanalytics-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48098
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-8-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-48099
Published: 2025-10-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/search-filter/vulnerability/wordpress-search-filter-plugin-1-2-17-cross-site-request-forgery-csrf-to-open-redirect-vulnerability?_s_id=cve
CVE: CVE-2025-48106
Published: 2025-10-22
Description: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Theme/clanora/vulnerability/wordpress-clanora-theme-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-48338
Published: 2025-10-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through <= 2.7.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-abstracts-manuscripts-manager/vulnerability/wordpress-wp-abstracts-plugin-2-7-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49060
Published: 2025-10-22
Description: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Theme/wastia/vulnerability/wordpress-wastia-theme-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49373
Published: 2025-10-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Cross Site Request Forgery.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/evergreen-content-poster/vulnerability/wordpress-evergreen-content-poster-plugin-1-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49374
Published: 2025-10-22
Description: Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-49376
Published: 2025-10-22
Description: Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-5-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49377
Published: 2025-10-22
Description: Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49378
Published: 2025-10-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49380
Published: 2025-10-22
Description: Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49899
Published: 2025-10-22
Description: Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-whydonate/vulnerability/wordpress-whydonate-plugin-4-0-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49901
Published: 2025-10-22
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-14-8-1-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-49903
Published: 2025-10-22
Description: Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/zoloblocks/vulnerability/wordpress-zoloblocks-plugin-2-3-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49906
Published: 2025-10-22
Description: Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49907
Published: 2025-10-22
Description: Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-3-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49908
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpc-countdown-timer/vulnerability/wordpress-wpc-countdown-timer-for-woocommerce-plugin-3-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49910
Published: 2025-10-22
Description: Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49911
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49912
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49913
Published: 2025-10-22
Description: Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49915
Published: 2025-10-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-8-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49916
Published: 2025-10-22
Description: Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-4-2-23-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49917
Published: 2025-10-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through <= 5.9.5.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/email-subscribers-premium/vulnerability/wordpress-icegram-express-pro-plugin-5-9-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-49920
Published: 2025-10-22
Description: Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/accessibe/vulnerability/wordpress-web-accessibility-by-accessibe-plugin-2-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49921
Published: 2025-10-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49922
Published: 2025-10-22
Description: Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpematico/vulnerability/wordpress-wpematico-rss-feed-fetcher-plugin-2-8-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49923
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-11-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49924
Published: 2025-10-22
Description: Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.4.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-wholesale-prices/vulnerability/wordpress-wholesale-suite-plugin-2-2-4-2-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-49925
Published: 2025-10-22
Description: Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49926
Published: 2025-10-22
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through <= 3.25.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Theme/kalium/vulnerability/wordpress-kalium-theme-3-25-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-49927
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-woo-builder/vulnerability/wordpress-jetwoobuilder-plugin-2-1-20-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49928
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-woo-builder/vulnerability/wordpress-jetwoobuilder-plugin-2-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49929
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-plugin-3-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49930
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49931
Published: 2025-10-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through <= 3.5.10.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49932
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49933
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49934
Published: 2025-10-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-plugin-1-3-18-cross-site-scripting-xss-vulnerability?_s_id=cve