deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-31836
Published: 2025-04-01
Description: Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through <= 2.5.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/review-manager/vulnerability/wordpress-review-manager-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31837
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-proposals/vulnerability/wordpress-wp-proposals-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31838
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eventbee Eventbee RSVP Widget eventbee-rsvp-widget allows DOM-Based XSS.This issue affects Eventbee RSVP Widget: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eventbee-rsvp-widget/vulnerability/wordpress-eventbee-rsvp-widget-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31839
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in digireturn DN Footer Contacts dn-footer-contacts allows Cross Site Request Forgery.This issue affects DN Footer Contacts: from n/a through <= 1.8.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dn-footer-contacts/vulnerability/wordpress-footer-contacts-bar-plugin-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31840
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in digireturn Simple Fixed Notice dn-cookie-notice allows Cross Site Request Forgery.This issue affects Simple Fixed Notice: from n/a through <= 1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dn-cookie-notice/vulnerability/wordpress-simple-fixed-notice-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31842
Published: 2025-04-01
Description: Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Sensitive Data.This issue affects Viral Loops WP Integration: from n/a through <= 3.4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/viral-loops-wp-integration/vulnerability/wordpress-viral-loops-wp-integration-plugin-3-4-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-31843
Published: 2025-04-01
Description: Missing Authorization vulnerability in Wilson OpenAI Tools for WordPress & WooCommerce openai-tools-for-wp-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OpenAI Tools for WordPress & WooCommerce: from n/a through <= 2.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/openai-tools-for-wp-wc/vulnerability/wordpress-openai-tools-for-wordpress-woocommerce-plugin-2-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31844
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Blocks magical-blocks allows Stored XSS.This issue affects Magical Blocks: from n/a through <= 1.0.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magical-blocks/vulnerability/wordpress-magical-blocks-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31845
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rohit Choudhary Theme Duplicator theme-duplicator allows Cross Site Request Forgery.This issue affects Theme Duplicator: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/theme-duplicator/vulnerability/wordpress-theme-duplicator-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31846
Published: 2025-04-01
Description: Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.18.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/theatre/vulnerability/wordpress-theater-for-wordpress-plugin-0-18-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31847
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through <= 1.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mfolio-lite/vulnerability/wordpress-mfolio-lite-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31848
Published: 2025-04-01
Description: Missing Authorization vulnerability in WPFactory Adverts adverts-click-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Adverts: from n/a through <= 1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/adverts-click-tracker/vulnerability/wordpress-wordpress-adverts-plugin-plugin-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31849
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fbtemplates Nemesis All-in-One nemesis-all-in-one allows Stored XSS.This issue affects Nemesis All-in-One: from n/a through <= 1.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nemesis-all-in-one/vulnerability/wordpress-nemesis-all-in-one-newspaper-builder-elementor-extention-plugin-1-1-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31850
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 2.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-generator-addon-for-elementor-page-builder/vulnerability/wordpress-pdf-generator-addon-for-elementor-page-builder-plugin-1-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31851
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.27.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beds24-online-booking/vulnerability/wordpress-beds24-online-booking-plugin-2-0-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31852
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in N-Media Bulk Product Sync sync-wc-google allows Cross Site Request Forgery.This issue affects Bulk Product Sync: from n/a through <= 8.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sync-wc-google/vulnerability/wordpress-bulk-product-sync-plugin-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31853
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Popup smartarget-popup allows Stored XSS.This issue affects Smartarget Popup: from n/a through <= 1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smartarget-popup/vulnerability/wordpress-smartarget-popup-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31854
Published: 2025-04-01
Description: Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through <= 1.4.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sticky-add-to-cart-woo/vulnerability/wordpress-simple-sticky-add-to-cart-for-woocommerce-plugin-1-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31855
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through <= 6.0.31.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smm-api/vulnerability/wordpress-smm-api-plugin-6-0-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31856
Published: 2025-04-01
Description: Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export All Post Meta: from n/a through <= 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/export-all-post-meta/vulnerability/wordpress-export-all-post-meta-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31857
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor addonskit-for-elementor allows Stored XSS.This issue affects Directorist AddonsKit for Elementor: from n/a through <= 1.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/addonskit-for-elementor/vulnerability/wordpress-directorist-addonskit-for-elementor-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31859
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Feedbucket Feedbucket – Website Feedback Tool feedbucket allows Cross Site Request Forgery.This issue affects Feedbucket – Website Feedback Tool: from n/a through <= 1.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/feedbucket/vulnerability/wordpress-feedbucket-website-feedback-tool-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31860
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.5.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpadcenter/vulnerability/wordpress-wp-adcenter-plugin-2-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31861
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPOrbit Support Perfect Font Awesome Integration perfect-font-awesome-integration allows Stored XSS.This issue affects Perfect Font Awesome Integration: from n/a through <= 2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/perfect-font-awesome-integration/vulnerability/wordpress-perfect-font-awesome-integration-plugin-2-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31862
Published: 2025-04-01
Description: Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-60-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-31863
Published: 2025-04-01
Description: Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Agency Toolkit: from n/a through <= 1.0.24.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/agency-toolkit/vulnerability/wordpress-agency-toolkit-plugin-1-0-23-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31864
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through <= 1.0.23.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beam-me-up-scotty/vulnerability/wordpress-beam-me-up-scotty-back-to-top-button-plugin-1-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31865
Published: 2025-04-01
Description: Missing Authorization vulnerability in CartBoss CartBoss cartboss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartBoss: from n/a through <= 4.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cartboss/vulnerability/wordpress-cartboss-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31866
Published: 2025-04-01
Description: Missing Authorization vulnerability in Ship Depot ShipDepot for WooCommerce ship-depot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipDepot for WooCommerce: from n/a through <= 1.2.19.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ship-depot/vulnerability/wordpress-shipdepot-for-woocommerce-plugin-1-2-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31867
Published: 2025-04-01
Description: Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-31868
Published: 2025-04-01
Description: Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31869
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/black-widgets/vulnerability/wordpress-black-widgets-for-elementor-plugin-1-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31870
Published: 2025-04-01
Description: Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-autokeyword/vulnerability/wordpress-wp-autokeyword-plugin-1-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-31871
Published: 2025-04-01
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue affects WP Clone any post type: from n/a through <= 3.6.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/wp-clone-any-post-type/vulnerability/wordpress-wp-clone-any-post-type-plugin-3-4-open-redirect-vulnerability?_s_id=cve
CVE: CVE-2025-31872
Published: 2025-04-01
Description: Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Clone any post type: from n/a through <= 3.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-clone-any-post-type/vulnerability/wordpress-wp-clone-any-post-type-plugin-3-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31873
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sheetdb SheetDB sheetdb allows Stored XSS.This issue affects SheetDB: from n/a through <= 1.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sheetdb/vulnerability/wordpress-sheetdb-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31874
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay WebberZone Snippetz add-to-all allows Stored XSS.This issue affects WebberZone Snippetz: from n/a through <= 2.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-to-all/vulnerability/wordpress-webberzone-snippetz-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31875
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginic FancyPost post-block allows DOM-Based XSS.This issue affects FancyPost: from n/a through <= 6.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-block/vulnerability/wordpress-fancypost-plugin-6-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31877
Published: 2025-04-01
Description: Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/restropress/vulnerability/wordpress-restropress-plugin-3-1-8-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31878
Published: 2025-04-01
Description: Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/upc-ean-barcode-generator/vulnerability/wordpress-upc-ean-gtin-code-generator-plugin-2-0-2-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-31879
Published: 2025-04-01
Description: Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/embedding-barcodes-into-product-pages-and-orders/vulnerability/wordpress-barcode-generator-for-woocommerce-plugin-2-0-4-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-31880
Published: 2025-04-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a through <= 1.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pearl-header-builder/vulnerability/wordpress-pearl-plugin-1-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31881
Published: 2025-04-01
Description: Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pearl: from n/a through <= 1.3.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pearl-header-builder/vulnerability/wordpress-pearl-plugin-1-3-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31882
Published: 2025-04-01
Description: Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-webinarsystem/vulnerability/wordpress-wordpress-webinar-plugin-1-33-27-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31883
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Stored XSS.This issue affects WebinarPress: from n/a through <= 1.33.28.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-webinarsystem/vulnerability/wordpress-webinarpress-plugin-1-33-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31884
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Stored XSS.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/norse-runes-oracle/vulnerability/wordpress-norse-rune-oracle-plugin-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31885
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows DOM-Based XSS.This issue affects Hyperlink Group Block: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hyperlink-group-block/vulnerability/wordpress-hyperlink-group-block-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve