deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10045
Published: 2025-10-15
Description: The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3447130/onoffice-for-wp-websites/trunk/plugin/Record/RecordManagerReadListViewEstate.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=cve
CVE: CVE-2025-10051
Published: 2025-10-15
Description: The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://wordpress.org/plugins/demo-import-kit/; https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve
CVE: CVE-2025-10056
Published: 2025-10-15
Description: The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://wordpress.org/plugins/task-scheduler/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve
CVE: CVE-2025-10132
Published: 2025-10-15
Description: The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/dhivehi-text/tags/0.1/dhivehi-text.php#L105; https://www.wordfence.com/threat-intel/vulnerabilities/id/74ff6acc-b362-428a-b227-24282e0f2783?source=cve
CVE: CVE-2025-10133
Published: 2025-10-15
Description: The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/urlyar/trunk/urlyar.php#L604; https://www.wordfence.com/threat-intel/vulnerabilities/id/51867e4f-75be-4451-a[PII_REDACTED]1adf5?source=cve
CVE: CVE-2025-10135
Published: 2025-10-15
Description: The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-viewstl/; https://www.wordfence.com/threat-intel/vulnerabilities/id/882070df-8a76-490b-a77c-03cdf84c481f?source=cve
CVE: CVE-2025-10139
Published: 2025-10-15
Description: The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-bookwidgets/trunk/wp-bookwidgets.php#L163; https://plugins.trac.wordpress.org/changeset/3380322/; https://wordpress.org/plugins/wp-bookwidgets
CVE: CVE-2025-10140
Published: 2025-10-15
Description: The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/quick-login/trunk/src/Buttons.php#L85; https://wordpress.org/plugins/quick-login; https://www.wordfence.com/threat-intel/vulnerabilities/id/aabf1911-5c6f-4486-a750-d5c95f5815ba?source=cve
CVE: CVE-2025-10141
Published: 2025-10-15
Description: The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/digiseller/trunk/digiseller.php#L61; https://plugins.trac.wordpress.org/changeset/3394885/; https://wordpress.org/plugins/digiseller
CVE: CVE-2025-10186
Published: 2025-10-15
Description: The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378787%40wp-whydonate&new=3378787%40wp-whydonate&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-whydonate/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6f30bb-dec0-4776-b255-bb88c9d003c2?source=cve
CVE: CVE-2025-10194
Published: 2025-10-15
Description: The Shortcode Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/shortcode-button/trunk/shortcode-button.php#L65; https://wordpress.org/plugins/shortcode-button/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e8119092-d513-4e6c-ab83-d4a49ec66281?source=cve
CVE: CVE-2025-10293
Published: 2025-10-15
Description: The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://wordpress.org/plugins/keyy/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1850e6bd-04bc-4510-aba9-e[PII_REDACTED]1?source=cve
CVE: CVE-2025-10294
Published: 2025-10-15
Description: The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://wordpress.org/plugins/ownid-passwordless-login/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dd6008-e9b8-4a87-b1c7-0dc272850cbd?source=cve
CVE: CVE-2025-10299
Published: 2025-10-15
Description: The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379010%40create-temporary-login&new=3379010%40create-temporary-login&sfp_email=&sfph_mail=; https://wordpress.org/plugins/create-temporary-login/; https://www.wordfence.com/threat-intel/vulnerabilities/id/50946bc7-8d31-4376-bdcc-de7aad700503?source=cve
CVE: CVE-2025-10300
Published: 2025-10-15
Description: The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fme_nb_topbar_save_settings() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/topbar/trunk/admin/class-fme-nb-topbaradmin.php#L131; https://plugins.trac.wordpress.org/browser/topbar/trunk/admin/class-fme-nb-topbaradmin.php#L38; https://wordpress.org/plugins/topbar/
CVE: CVE-2025-10301
Published: 2025-10-15
Description: The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/funkitools/trunk/includes/controllers/options/page.php#L59; https://www.wordfence.com/threat-intel/vulnerabilities/id/36231136-58ec-4a6d-8cfc-d3d69c31037d?source=cve
CVE: CVE-2025-10303
Published: 2025-10-15
Description: The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the plugin's settings and features.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/library-management-system/trunk/admin/class-library-management-system-admin.php#L831; https://plugins.trac.wordpress.org/changeset/3382258; https://www.wordfence.com/threat-intel/vulnerabilities/id/9e45feb6-5ffa-4ad3-9[PII_REDACTED]f040e?source=cve
CVE: CVE-2025-10310
Published: 2025-10-15
Description: The Rich Snippet Site Report plugin for WordPress is vulnerable to  SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can also be exploited via CSRF.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/easysnippet/tags/2.0.0105/lib/EasySnippet.php#L100; https://wordpress.org/plugins/easysnippet/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2242c86e-c769-4104-b266-0cdcd90ccf63?source=cve
CVE: CVE-2025-10312
Published: 2025-10-15
Description: The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation when processing form submissions in the theme-importer.php file. This makes it possible for unauthenticated attackers to trigger arbitrary file downloads and potentially execute malicious operations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/theme-importer/trunk/theme-importer.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/9316796b-312f-4562-b92f-7de0129e4163?source=cve
CVE: CVE-2025-10313
Published: 2025-10-15
Description: The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/find-and-replace-content/trunk/function.php?rev=1601465; https://wordpress.org/plugins/find-and-replace-content/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c0469ece-6f5f-4774-8094-f7f67702a775?source=cve
CVE: CVE-2025-10486
Published: 2025-10-15
Description: The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://plugins.svn.wordpress.org/content-writer/tags/3.6.8/lib/sc_functions.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379612%40content-writer&new=3379612%40content-writer&sfp_email=&sfph_mail=; https://wordpress.org/plugins/content-writer/
CVE: CVE-2025-10575
Published: 2025-10-15
Description: The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-jquery-pdf-paged/trunk/wp-jquery-paged.php#L80; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=cve
CVE: CVE-2025-10648
Published: 2025-10-15
Description: The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/login-with-yourmembership/trunk/class-moym-sso.php#L112; https://plugins.trac.wordpress.org/browser/login-with-yourmembership/trunk/class-moym-sso.php#L88; https://plugins.trac.wordpress.org/changeset/3389623/
CVE: CVE-2025-10660
Published: 2025-10-15
Description: The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-dashboard-chat/tags/1.0.3/wp-dashboard-chat.php#L207; https://plugins.trac.wordpress.org/browser/wp-dashboard-chat/tags/1.0.3/wp-dashboard-chat.php#L99; https://www.wordfence.com/threat-intel/vulnerabilities/id/21ffbb00-7c84-4d00-9a7f-0e412d8d5ed7?source=cve
CVE: CVE-2025-10682
Published: 2025-10-15
Description: The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_admin.php#L36; https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_twl.php#L164; https://plugins.trac.wordpress.org/changeset/3465105/
CVE: CVE-2025-10730
Published: 2025-10-15
Description: The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-tabber-widget/trunk/wp-tabber-widget.php#L51; https://www.wordfence.com/threat-intel/vulnerabilities/id/317e17ac-74bd-44cd-8bae-aa893c588a46?source=cve
CVE: CVE-2025-10743
Published: 2025-10-15
Description: The Outdoor plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and including, 1.3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/outdoor/trunk/actions.php#L73; https://wordpress.org/plugins/outdoor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6038accc-98ac-496c-9c53-ec06b2045324?source=cve
CVE: CVE-2025-10754
Published: 2025-10-15
Description: The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/docodoco-store-locator/tags/1.0.1/includes/Admin/ZIP.php#L187; https://plugins.trac.wordpress.org/browser/docodoco-store-locator/tags/1.0.1/includes/Admin/ZIP.php#L275; https://www.wordfence.com/threat-intel/vulnerabilities/id/14759eb0-455f-4b7d-abab-4e4d89b32bb1?source=cve
CVE: CVE-2025-11177
Published: 2025-10-15
Description: The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database when a PostgreSQL or MSSQL database is configured as the external authentication database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/external-login/tags/1.11.2/login/db.php#L153; https://www.wordfence.com/threat-intel/vulnerabilities/id/488f1a2f-01c8-40cf-b52f-d707271105f5?source=cve
CVE: CVE-2025-11196
Published: 2025-10-15
Description: The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlog_test_connection' AJAX action lacking capability checks or nonce validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to query the configured external database and retrieve truncated usernames, email addresses, and password hashes via the diagnostic test results view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/external-login/trunk/login/db.php#L215; https://plugins.trac.wordpress.org/browser/external-login/trunk/options/testing_ajax.php#L3; https://plugins.trac.wordpress.org/browser/external-login/trunk/views/test_results.php#L21
CVE: CVE-2025-11365
Published: 2025-10-15
Description: The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-google-map/trunk/shortcode.php#L8; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ecc765-ae00-4091-81dc-e93f91bbd86e?source=cve