deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30463
Published: 2025-03-31
Description: The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; http://seclists.org/fulldisclosure/2025/Apr/4
CVE: CVE-2025-30464
Published: 2025-03-31
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-30465
Published: 2025-03-31
Description: A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sequoia 15.7.2, macOS Sonoma 14.7.5, macOS Sonoma 14.8.2, macOS Tahoe 26.1, macOS Ventura 13.7.5. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://support.apple.com/en-us/122372; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-30467
Published: 2025-03-31
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122376
CVE: CVE-2025-30469
Published: 2025-03-31
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person with physical access to an iOS device may be able to access photos from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-863
References: https://support.apple.com/en-us/122371; http://seclists.org/fulldisclosure/2025/Apr/4
CVE: CVE-2025-30470
Published: 2025-03-31
Description: A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, visionOS 2.4, watchOS 11.4. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-30471
Published: 2025-03-31
Description: A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may be able to cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122372; https://support.apple.com/en-us/122373
CVE: CVE-2025-31182
Published: 2025-03-31
Description: This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to delete files for which it does not have permission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-31183
Published: 2025-03-31
Description: The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-31184
Published: 2025-03-31
Description: This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. An app may gain unauthorized access to Local Network.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122378
CVE: CVE-2025-31187
Published: 2025-03-31
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-31188
Published: 2025-03-31
Description: A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to bypass Privacy preferences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-31191
Published: 2025-03-31
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-31192
Published: 2025-03-31
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-305
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122379
CVE: CVE-2025-31194
Published: 2025-03-31
Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-3037
Published: 2025-03-31
Description: A vulnerability has been found in yzk[PII_REDACTED] StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/yzk[PII_REDACTED]/StudentServlet-JSP/issues/3; https://github.com/yzk[PII_REDACTED]/StudentServlet-JSP/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.302098
CVE: CVE-2025-3038
Published: 2025-03-31
Description: A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view_account.php. The manipulation of the argument salary_rate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/nabiland/cve/blob/main/cve.md; https://vuldb.com/?ctiid.302099
CVE: CVE-2025-3039
Published: 2025-03-31
Description: A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add_employee.php. The manipulation of the argument lname/fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xuzhuojia22/cve/blob/main/cvexuzhoujia.md; https://vuldb.com/?ctiid.302100
CVE: CVE-2025-3040
Published: 2025-03-31
Description: A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_student.php. The manipulation of the argument pic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ydnd/cve/issues/11; https://vuldb.com/?ctiid.302102; https://vuldb.com/?id.302102
CVE: CVE-2025-3059
Published: 2025-03-31
Description: Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.drupal.org/sa-contrib-2025-002
CVE: CVE-2025-3060
Published: 2025-03-31
Description: Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.
CVSS Score: 6.6 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-005
CVE: CVE-2025-3061
Published: 2025-03-31
Description: Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.drupal.org/sa-contrib-2025-006
CVE: CVE-2025-3062
Published: 2025-03-31
Description: Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.drupal.org/sa-contrib-2025-010
CVE: CVE-2025-3041
Published: 2025-04-01
Description: A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/updatestudent.php. The manipulation of the argument pic leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ydnd/cve/issues/12; https://vuldb.com/?ctiid.302103; https://vuldb.com/?id.302103
CVE: CVE-2025-21384
Published: 2025-04-01
Description: An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
CVSS Score: 8.3 (HIGH)
CWE: CWE-693, CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21384
CVE: CVE-2025-3042
Published: 2025-04-01
Description: A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /student/updateprofile.php. The manipulation of the argument pic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ydnd/cve/issues/13; https://vuldb.com/?ctiid.302104; https://vuldb.com/?id.302104
CVE: CVE-2025-3043
Published: 2025-04-01
Description: A vulnerability, which was classified as critical, has been found in GuoMinJim PersonManage 1.0. This issue affects the function preHandle of the file /login/. The manipulation of the argument Request leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/GuoMinJim/PersonManage/issues/7; https://github.com/GuoMinJim/PersonManage/issues/7#issue[PII_REDACTED]; https://vuldb.com/?ctiid.302105
CVE: CVE-2025-3045
Published: 2025-04-01
Description: A vulnerability, which was classified as critical, was found in oretnom23/SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /remove-apartment.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/byxs0x0/SQL/blob/main/SQL2.md; https://vuldb.com/?ctiid.302106; https://vuldb.com/?id.302106
CVE: CVE-2025-30672
Published: 2025-04-01
Description: Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be 
loaded instead of the intended file, potentially leading to arbitrary 
code execution.

This affects the Mite distribution itself, and other distributions that contain code generated by Mite.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html; https://metacpan.org/release/TOBYINK/Mite-0.013000/changes; https://perldoc.perl.org/perlrun#PERL_USE_UNSAFE_INC
CVE: CVE-2025-30673
Published: 2025-04-01
Description: Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.

Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html; https://metacpan.org/dist/Sub-HandlesVia/changes#L12; https://metacpan.org/release/TOBYINK/Sub-HandlesVia-0.050001/source/lib/Sub/HandlesVia/Mite.pm#L114
CVE: CVE-2025-3051
Published: 2025-04-01
Description: Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.

Linux::Statm::Tiny uses Mite to produce the affected code section due to CVE-2025-30672
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html; https://metacpan.org/release/RRWO/Linux-Statm-Tiny-0.0700/source/lib/Linux/Statm/Tiny/Mite.pm#L82; https://metacpan.org/release/RRWO/Linux-Statm-Tiny-0.0701/changes
CVE: CVE-2025-0416
Published: 2025-04-01
Description: Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.
CWE: CWE-269
References: https://www.valmet.com/about-us/about/research-and-development/vulnerabilityadvisories/cve-2025-0416/
CVE: CVE-2025-0417
Published: 2025-04-01
Description: Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.
CWE: CWE-307
References: https://www.valmet.com/about-us/about/research-and-development/vulnerabilityadvisories/cve-2025-0417/
CVE: CVE-2025-0418
Published: 2025-04-01
Description: Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.
CWE: CWE-312
References: https://www.valmet.com/about-us/about/research-and-development/vulnerabilityadvisories/cve-2025-0418/
CVE: CVE-2025-1534
Published: 2025-04-01
Description: CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.payara.fish/community/docs/6.2025.3/Release%20Notes/Release%20Notes%206.2025.3.html; https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.24.0.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2025-2007
Published: 2025-04-01
Description: The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-23
References: https://plugins.trac.wordpress.org/changeset/3261521/wp-ultimate-csv-importer/trunk/MediaHandling.php; https://plugins.trac.wordpress.org/changeset/3266286/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3923c732-80b5-4a04-80dd-b4d5b5e5567d?source=cve
CVE: CVE-2025-2008
Published: 2025-04-01
Description: The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3261521/wp-ultimate-csv-importer/trunk/SingleImportExport.php; https://plugins.trac.wordpress.org/changeset/3266286/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a114faf9-cada-4132-abe3-c0137b66e276?source=cve
CVE: CVE-2024-13567
Published: 2025-04-01
Description: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/file-uploader/class-file-uploader.php; https://plugins.trac.wordpress.org/changeset/3250497/; https://plugins.trac.wordpress.org/changeset/3262629/
CVE: CVE-2025-1665
Published: 2025-04-01
Description: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://avada.com; https://www.wordfence.com/threat-intel/vulnerabilities/id/94e373fb-b3f5-4c1b-9eaa-89747af4dc30?source=cve
CVE: CVE-2025-1986
Published: 2025-04-01
Description: The Gutentor  WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/f1414750-19ee-4a5d-b255-a9c20168b716/
CVE: CVE-2025-22277
Published: 2025-04-01
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-1-4-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-2048
Published: 2025-04-01
Description: The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/05c664e8-110e-4a31-8377-41a0422508a7/
CVE: CVE-2025-30520
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-forms allows Reflected XSS.This issue affects Breezing Forms: from n/a through <= 1.2.8.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/breezing-forms/vulnerability/wordpress-breezing-forms-plugin-1-2-8-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30544
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ok-poster-group/vulnerability/wordpress-ok-poster-group-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30547
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards wp-cards allows Reflected XSS.This issue affects WP Cards: from n/a through <= 1.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-cards/vulnerability/wordpress-wp-cards-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30548
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-post-search/vulnerability/wordpress-advanced-post-search-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve