deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8316
Published: 2025-09-11
Description: The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/certifica-wp/tags/3.1/certificawp.php; https://wordpress.org/plugins/certifica-wp/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7f5355-b87b-4720-8998-c081d005827b?source=cve
CVE: CVE-2025-8318
Published: 2025-09-11
Description: The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/jobify/tags/1.4.4/src/Jobify/Shortcodes.php; https://wordpress.org/plugins/jobify/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e528d16-4a5d-4ef9-baac-e235fa3b4be3?source=cve
CVE: CVE-2025-8392
Published: 2025-09-11
Description: The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/mitfahrgelegenheit/tags/v1.1.5/mitfahrgelegenheit.php; https://wordpress.org/plugins/mitfahrgelegenheit/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=cve
CVE: CVE-2025-8398
Published: 2025-09-11
Description: The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/azurecurve-bbcode/tags/2.0.4/azurecurve-bbcode.php; https://wordpress.org/plugins/azurecurve-bbcode/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4eb61dd-f28e-4d8a-8f97-958b6a356309?source=cve
CVE: CVE-2025-8417
Published: 2025-09-11
Description: The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L20; https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L244; https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L272
CVE: CVE-2025-8422
Published: 2025-09-11
Description: The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Email.php#L275; https://plugins.trac.wordpress.org/changeset/3361482/propovoice/trunk/includes/Api/Type/Email.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac72d7a-9540-435f-93cb-fdd4104b18f7?source=cve
CVE: CVE-2025-8423
Published: 2025-09-11
Description: The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048; https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069; https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130
CVE: CVE-2025-8425
Published: 2025-09-11
Description: The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_import_strings() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1116; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef46b08f-455a-4c61-81ac-10af19b16980?source=cve
CVE: CVE-2025-8445
Published: 2025-09-11
Description: The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/countdown-timer-for-elementor/trunk/widgets/countdown-timer-widget.php#L513; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=cve
CVE: CVE-2025-8481
Published: 2025-09-11
Description: The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This is due to missing or incorrect nonce validation on the bdfe_install_activate_rswpbs_only function. This makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/blog-designer-for-elementor/tags/1.1.7/inc/import-books-from-amazon-notice/import-books-from-amazon-notice.php#L109; https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f31f8e-03a0-436c-bfa3-bc41d70e8e2a?source=cve
CVE: CVE-2025-8492
Published: 2025-09-11
Description: The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.22. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.20/src/SLN/Plugin.php#L232; https://plugins.trac.wordpress.org/changeset/3360651/salon-booking-system/trunk/src/SLN/Action/Ajax/UploadFile.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9a63a4ec-80e6-48cc-a778-97fa3917817e?source=cve
CVE: CVE-2025-8570
Published: 2025-09-11
Description: The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365845%40beyondcart&new=3365845%40beyondcart&sfp_email=&sfph_mail=; https://wordpress.org/plugins/beyondcart/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0dd4fc0-1c6a-4556-b219-893563a27a69?source=cve
CVE: CVE-2025-8686
Published: 2025-09-11
Description: The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/wp-easy-faqs/tags/1.0.5/admin/class-wp-easy-faqs-admin.php; https://plugins.svn.wordpress.org/wp-easy-faqs/tags/1.0.5/includes/class-wp-easy-faqs-shortcode.php; https://wordpress.org/plugins/wp-easy-faqs/#developers
CVE: CVE-2025-8689
Published: 2025-09-11
Description: The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3361885%40elements-plus&new=3361885%40elements-plus&sfp_email=&sfph_mail=; https://wordpress.org/plugins/elements-plus/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/bdebb4a6-1bf8-4a61-b690-cf933215216a?source=cve
CVE: CVE-2025-8691
Published: 2025-09-11
Description: The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/wp-scriptcase/trunk/wpscriptcase.php; https://wordpress.org/plugins/wp-scriptcase/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f6cb6fbc-456d-4912-a574-cb25ab16df3a?source=cve
CVE: CVE-2025-8692
Published: 2025-09-11
Description: The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log_duration’ parameter in all versions up to, and including, 6.2.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L530; https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L559; https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L577
CVE: CVE-2025-8721
Published: 2025-09-11
Description: The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/wrapper-for-workable-api/tags/1.0.4/workable-api.php; https://wordpress.org/plugins/wrapper-for-workable-api/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/01cf3196-1817-4506-8f70-ca54cc5e09f9?source=cve
CVE: CVE-2025-9073
Published: 2025-09-11
Description: The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve
CVE: CVE-2025-9123
Published: 2025-09-11
Description: The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address parameters in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392721%40cbxgooglemap&new=3392721%40cbxgooglemap&sfp_email=&sfph_mail=; https://wordpress.org/plugins/cbxgooglemap/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ebad60ee-8596-46c8-9461-9caf6c6a3454?source=cve
CVE: CVE-2025-9128
Published: 2025-09-11
Description: The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smart-id/trunk/smart-id.php#L240; https://plugins.trac.wordpress.org/changeset/3360490; https://wordpress.org/plugins/smart-id/#developers
CVE: CVE-2025-9451
Published: 2025-09-11
Description: The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 3.1.72 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Services/App/Includes/TranslationRequestFinder.php#L30; https://plugins.trac.wordpress.org/changeset/3368366/; https://wordpress.org/plugins/smartcat-wpml/#developers
CVE: CVE-2025-9617
Published: 2025-09-11
Description: The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/publish-approval/trunk/src/actions/HandleOptionsSave.php#L6; https://www.wordfence.com/threat-intel/vulnerabilities/id/e34ac4aa-65c5-43d7-9b77-d4c6068722f1?source=cve
CVE: CVE-2025-9620
Published: 2025-09-11
Description: The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the check_integration() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/seo-monster/trunk/inc/class_seo_monster_ui.php#L69; https://plugins.trac.wordpress.org/browser/seo-monster/trunk/tpl/integration.php#L42; https://www.wordfence.com/threat-intel/vulnerabilities/id/d224151c-0fe2-4032-a847-39628cc2f520?source=cve
CVE: CVE-2025-9623
Published: 2025-09-11
Description: The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the enable_eng function. This makes it possible for unauthenticated attackers to modify administrator language settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/admin-in-english-with-switch/tags/1.1/admin-in-english-with-switch.php#L106; https://plugins.trac.wordpress.org/browser/admin-in-english-with-switch/tags/1.1/admin-in-english-with-switch.php#L113; https://www.wordfence.com/threat-intel/vulnerabilities/id/9ffb0980-75f8-4f6b-a0ed-2f65bc5aa103?source=cve
CVE: CVE-2025-9627
Published: 2025-09-11
Description: The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on the oirl_plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings including distance units, pace display preferences, style themes, and display positions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/run-log/trunk/run-log.php#L143; https://plugins.trac.wordpress.org/changeset/3361381/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9ba35b-5ef8-4170-97f4-400fe9bd3af2?source=cve
CVE: CVE-2025-9628
Published: 2025-09-11
Description: The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to modify critical API connection settings including the AMO.CRM API URL, login credentials, and API hash key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/leads-for-amo-crm/tags/1.0.1/amocrmleads.php#L64; https://plugins.trac.wordpress.org/browser/leads-for-amo-crm/tags/1.0.1/main.php#L10; https://www.wordfence.com/threat-intel/vulnerabilities/id/3623713f-ad39-429c-890f-cd113efb905a?source=cve
CVE: CVE-2025-9631
Published: 2025-09-11
Description: The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatset_ajax function. This makes it possible for unauthenticated attackers to trigger automatic recategorization of posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/autocatset/trunk/autocatset.php#L93; https://plugins.trac.wordpress.org/browser/autocatset/trunk/lib/ajax.php#L5; https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3bd31f-0f5a-4b4a-811b-5482db866bd5?source=cve
CVE: CVE-2025-9632
Published: 2025-09-11
Description: The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/phpls/tags/1.1/admin/init.php#L45; https://plugins.trac.wordpress.org/browser/phpls/tags/1.1/admin/init.php#L60; https://www.wordfence.com/threat-intel/vulnerabilities/id/e8[PII_REDACTED]-42cd-aed6-7ec61c3ced85?source=cve
CVE: CVE-2025-9633
Published: 2025-09-11
Description: The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/lh-signing/trunk/lh-signing.php#L1870; https://plugins.trac.wordpress.org/browser/lh-signing/trunk/lh-signing.php#L1886; https://plugins.trac.wordpress.org/browser/lh-signing/trunk/partials/option-settings.php#L3
CVE: CVE-2025-9634
Published: 2025-09-11
Description: The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/plugin-update-blocker/tags/0.2/dpu-menu.php#L3; https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=cve