deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-31039
Published: 2025-06-09
Description: Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through <= 1.0.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://patchstack.com/database/Wordpress/Plugin/category-icon/vulnerability/wordpress-category-icon-plugin-1-0-2-xml-external-entity-xxe-vulnerability?_s_id=cve
CVE: CVE-2025-31045
Published: 2025-06-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/elfsight-contact-form/vulnerability/wordpress-elfsight-contact-form-widget-2-3-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-31050
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through <= 2.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/apptha-slider-gallery/vulnerability/wordpress-apptha-slider-gallery-plugin-2-5-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2025-31052
Published: 2025-06-09
Description: Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/nrgfashion/vulnerability/wordpress-the-fashion-model-agency-one-page-beauty-theme-1-4-4-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-31057
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 1.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementor_widget_universal_video_player/vulnerability/wordpress-universal-video-player-plugin-1-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31058
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player revolution_video_player allows Reflected XSS.This issue affects Revolution Video Player: from n/a through <= 2.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/revolution_video_player/vulnerability/wordpress-revolution-video-player-plugin-2-9-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31059
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Product Table PRO woo-producttables-pro allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through <= 2.2.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-producttables-pro/vulnerability/wordpress-wbw-product-table-pro-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31061
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-plugin-2-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31396
Published: 2025-06-09
Description: Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/flap/vulnerability/wordpress-flap-business-wordpress-theme-1-5-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31398
Published: 2025-06-09
Description: Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/pimp/vulnerability/wordpress-pimp-creative-multipurpose-1-7-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-31424
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/leadcapture/vulnerability/wordpress-wp-lead-capturing-pages-plugin-2-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31426
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio5-html5-shoutcast_sticky/vulnerability/wordpress-sticky-radio-player-plugin-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31429
Published: 2025-06-09
Description: Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/press-grid/vulnerability/wordpress-pressgrid-frontend-publish-reaction-multimedia-theme-1-3-1-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-31635
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows Path Traversal.This issue affects CLEVER: from n/a through <= 2.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio11-html5-shoutcast_history/vulnerability/wordpress-clever-2-6-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-31638
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31917
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/universal_video_player/vulnerability/wordpress-universal-video-player-plugin-3-8-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31920
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech WP Guppy wp-guppy allows SQL Injection.This issue affects WP Guppy: from n/a through <= 4.3.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-guppy/vulnerability/wordpress-wp-guppy-4-3-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31925
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows Reflected XSS.This issue affects SHOUT: from n/a through <= 3.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio8-html5-radio_ads/vulnerability/wordpress-shout-plugin-3-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32291
Published: 2025-06-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/affs/vulnerability/wordpress-sumo-affiliates-pro-10-7-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-32305
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/flatnews/vulnerability/wordpress-flatnews-theme-5-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32308
Published: 2025-06-09
Description: Missing Authorization vulnerability in looks_awesome Team Builder a-team-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Builder: from n/a through <= 1.5.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/a-team-showcase/vulnerability/wordpress-team-builder-1-5-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32595
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd krowd allows PHP Local File Inclusion.This issue affects Krowd: from n/a through < 1.5.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/krowd/vulnerability/wordpress-krowd-1-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39473
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclusion.This issue affects Seofy Core: from n/a through <= 1.6.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/seofy-core/vulnerability/wordpress-seofy-core-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39475
Published: 2025-06-09
Description: Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Theme/arlo/vulnerability/wordpress-arlo-6-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39476
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo revo allows PHP Local File Inclusion.This issue affects Revo: from n/a through <= 4.0.26.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/revo/vulnerability/wordpress-revo-theme-4-0-26-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39539
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through <= 1.20.11.23.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-email-delivery/vulnerability/wordpress-wp-email-delivery-plugin-1-20-11-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-45055
Published: 2025-06-09
Description: Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Silverpeas/Silverpeas-Core/pull/1394; https://medium.com/@mingihongkim/privilege-escalation-via-svg-injection-in-silverpeas-6-4-2-b5ab1d5b6955; https://medium.com/@mingihongkim/privilege-escalation-via-svg-injection-in-silverpeas-6-4-2-b5ab1d5b6955
CVE: CVE-2025-46178
Published: 2025-06-09
Description: Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SacX-7/CVE-2025-46178/blob/main/Cross-Site%20Scripting%20%28XSS%29%20in%20CloudClassroom%20PHP%20Project; https://github.com/SacX-7/CVE-2025-46178/blob/main/Cross-Site%20Scripting%20%28XSS%29%20in%20CloudClassroom%20PHP%20Project
CVE: CVE-2025-47463
Published: 2025-06-09
Description: Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 2.8.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/stock-locations-for-woocommerce/vulnerability/wordpress-stock-locations-for-woocommerce-2-8-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47477
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-time-capsule/vulnerability/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47487
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-wishlist-for-more-convert/vulnerability/wordpress-mc-woocommerce-wishlist-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47511
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-2-11-13-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-47527
Published: 2025-06-09
Description: Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47561
Published: 2025-06-09
Description: Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-8-5-34-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-47598
Published: 2025-06-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 history-log-by-click5 allows Stored XSS.This issue affects History Log by click5: from n/a through <= 1.0.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/history-log-by-click5/vulnerability/wordpress-history-log-by-click5-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47608
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/recover-wc-abandoned-cart/vulnerability/wordpress-recover-abandoned-cart-for-woocommerce-2-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47651
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-2-11-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48122
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48123
Published: 2025-06-09
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-48124
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-48125
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <= 3.1.51.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-manager/vulnerability/wordpress-wp-event-manager-3-1-49-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48126
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/essential-real-estate/vulnerability/wordpress-essential-real-estate-5-2-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48129
Published: 2025-06-09
Description: Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-48130
Published: 2025-06-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-48139
Published: 2025-06-09
Description: Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through <= 1.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/relentlosoftware/vulnerability/wordpress-styleai-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48140
Published: 2025-06-09
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/metalpriceapi/vulnerability/wordpress-metalpriceapi-1-1-4-remote-code-execution-rce-vulnerability?_s_id=cve