deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29036
Published: 2025-04-01
Description: An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-266
References: https://github.com/HypeDuke/vulnerable-research/blob/main/CVE-2025-29036; https://github.com/sahat/hackathon-starter/issues/1326; https://github.com/sahat/hackathon-starter/pull/1328
CVE: CVE-2025-29049
Published: 2025-04-01
Description: Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/advisories/GHSA-qwj6-q94f-8425; https://github.com/arnog/mathlive/commit/abc26056fd5e29a99edfa96a0bbe855ea2a8b678; https://github.com/advisories/GHSA-qwj6-q94f-8425
CVE: CVE-2025-29070
Published: 2025-04-01
Description: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://github.com/mm2/Little-CMS/issues/475; https://github.com/mm2/Little-CMS/issues/475#issuecomment[PII_REDACTED]
CVE: CVE-2025-30554
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abhishek Kumar Frizzly frizzly allows Reflected XSS.This issue affects Frizzly: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/frizzly/vulnerability/wordpress-frizzly-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30580
Published: 2025-04-01
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through <= 1.10.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/digiwidgets-image-editor/vulnerability/wordpress-digiwidgets-image-editor-1-10-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-30778
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/v-form/vulnerability/wordpress-vform-plugin-3-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30807
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martin Nguyen Next-Cart Store to WooCommerce Migration nextcart-woocommerce-migration allows SQL Injection.This issue affects Next-Cart Store to WooCommerce Migration: from n/a through <= 3.9.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/nextcart-woocommerce-migration/vulnerability/wordpress-next-cart-store-to-woocommerce-migration-plugin-3-9-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30825
Published: 2025-04-01
Description: Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpc-smart-linked-products/vulnerability/wordpress-wpc-smart-linked-products-plugin-1-3-5-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-30841
Published: 2025-04-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in adamskaat Countdown & Clock countdown-builder allows Remote Code Inclusion.This issue affects Countdown & Clock: from n/a through <= 2.8.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/countdown-builder/vulnerability/wordpress-countdown-clock-plugin-2-8-8-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-30844
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Watu Quiz watu allows Reflected XSS.This issue affects Watu Quiz: from n/a through <= 3.4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/watu/vulnerability/wordpress-watu-quiz-plugin-3-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30852
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through <= 1.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/oracle-cards/vulnerability/wordpress-oracle-cards-lite-plugin-1-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30853
Published: 2025-04-01
Description: Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.10.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/shortpixel-adaptive-images/vulnerability/wordpress-shortpixel-adaptive-images-plugin-3-10-0-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-30892
Published: 2025-04-01
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n/a through <= 1.8.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-1-8-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30905
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 4.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/secure-copy-content-protection/vulnerability/wordpress-secure-copy-content-protection-and-content-locking-plugin-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30906
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lisandragetnet Plugin Oficial – Getnet para WooCommerce wc-checkout-getnet allows Reflected XSS.This issue affects Plugin Oficial – Getnet para WooCommerce: from n/a through <= 1.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-checkout-getnet/vulnerability/wordpress-plugin-oficial-getnet-para-woocommerce-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30913
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podpirate Access Areas wp-access-areas allows Reflected XSS.This issue affects Access Areas: from n/a through <= 1.5.19.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-access-areas/vulnerability/wordpress-access-areas-plugin-1-5-19-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31078
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Reflected XSS.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/small-package-quotes-wwe-edition/vulnerability/wordpress-small-package-quotes-worldwide-express-edition-plugin-5-2-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31080
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/html-forms/vulnerability/wordpress-html-forms-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31081
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Reflected XSS.This issue affects Enable Media Replace: from n/a through <= 4.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31082
Published: 2025-04-01
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/blog-designer-pack/vulnerability/wordpress-news-blog-designer-pack-plugin-4-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31085
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through <= 2.21.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xili-language/vulnerability/wordpress-xili-language-plugin-2-21-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31086
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WBW Plugins Product Table by WBW woo-product-tables allows Reflected XSS.This issue affects Product Table by WBW: from n/a through <= 2.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-tables/vulnerability/wordpress-product-table-by-wbw-plugin-2-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31089
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fahad Mahmood Order Splitter for WooCommerce woo-order-splitter allows SQL Injection.This issue affects Order Splitter for WooCommerce: from n/a through <= 5.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-order-splitter/vulnerability/wordpress-order-splitter-for-woocommerce-5-3-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31097
Published: 2025-04-01
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31431
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in conlabz GmbH WP Bookmarks wp-bookmarks allows Reflected XSS.This issue affects WP Bookmarks: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-bookmarks/vulnerability/wordpress-wp-bookmarks-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31441
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S WordPress Galleria wp-galleria allows Reflected XSS.This issue affects WordPress Galleria: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-galleria/vulnerability/wordpress-wordpress-galleria-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31445
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sed Lex Pages Order pages-order allows Reflected XSS.This issue affects Pages Order: from n/a through <= 1.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pages-order/vulnerability/wordpress-pages-order-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31446
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jiangmiao WP Cleaner wpcleaner allows Reflected XSS.This issue affects WP Cleaner: from n/a through <= 1.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcleaner/vulnerability/wordpress-wp-cleaner-plugin-1-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31454
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/delete-post-revision/vulnerability/wordpress-delete-post-revision-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31455
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ralxz Limit Max IPs Per User limit-max-ips-per-user allows DOM-Based XSS.This issue affects Limit Max IPs Per User: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/limit-max-ips-per-user/vulnerability/wordpress-limit-max-ips-per-user-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31461
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mayeenul Islam NanoSupport nanosupport allows Reflected XSS.This issue affects NanoSupport: from n/a through <= 0.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nanosupport/vulnerability/wordpress-nanosupport-plugin-0-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31462
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar cgm-event-calendar allows Reflected XSS.This issue affects CGM Event Calendar: from n/a through <= 0.8.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cgm-event-calendar/vulnerability/wordpress-cgm-event-calendar-0-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31525
Published: 2025-04-01
Description: Missing Authorization vulnerability in WP Messiah WP Mobile Bottom Menu mobile-bottom-menu-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mobile Bottom Menu: from n/a through <= 1.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mobile-bottom-menu-for-wp/vulnerability/wordpress-wp-mobile-bottom-menu-plugin-1-2-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31531
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in click5 History Log by click5 history-log-by-click5 allows SQL Injection.This issue affects History Log by click5: from n/a through <= 1.0.13.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/history-log-by-click5/vulnerability/wordpress-history-log-by-click5-plugin-1-0-13-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31534
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shopperdotcom Shopper shopper allows SQL Injection.This issue affects Shopper: from n/a through <= 3.2.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/shopper/vulnerability/wordpress-shopper-plugin-3-2-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31537
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madfishdigital Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish allows Reflected XSS.This issue affects Bulk NoIndex & NoFollow Toolkit: from n/a through <= 2.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bulk-noindex-nofollow-toolkit-by-mad-fish/vulnerability/wordpress-bulk-noindex-nofollow-toolkit-plugin-2-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31548
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Reflected XSS.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-push-notifications/vulnerability/wordpress-ultimate-push-notifications-plugin-1-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31550
Published: 2025-04-01
Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in thom4 WP-LESS wp-less allows Retrieve Embedded Sensitive Data.This issue affects WP-LESS: from n/a through <= 1.9.6.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-538
References: https://patchstack.com/database/Wordpress/Plugin/wp-less/vulnerability/wordpress-wp-less-plugin-1-9-3-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-31551
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms gf-salesmate-add-on allows SQL Injection.This issue affects Salesmate Add-On for Gravity Forms: from n/a through <= 2.0.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gf-salesmate-add-on/vulnerability/wordpress-salesmate-add-on-for-gravity-forms-plugin-2-0-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31552
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker  rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.6.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rsvpmaker/vulnerability/wordpress-rsvpmarker-plugin-11-4-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31553
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/webd-woocommerce-advanced-reporting-statistics/vulnerability/wordpress-advanced-woocommerce-product-sales-reporting-plugin-3-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31560
Published: 2025-04-01
Description: Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Privilege Escalation.This issue affects Salon booking system: from n/a through < 10.15.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-11-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31561
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows SQL Injection.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-push-notifications/vulnerability/wordpress-ultimate-push-notifications-plugin-1-1-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31563
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar open-ai-search-bar allows Stored XSS.This issue affects AI Search Bar: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/open-ai-search-bar/vulnerability/wordpress-ai-search-bar-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31564
Published: 2025-04-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Blind SQL Injection.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.2.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ai-auto-tool/vulnerability/chatgpt-ai-auto-tool-content-writing-assistant-gemini-writer-chatgpt-all-in-one-plugin-2-1-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31568
Published: 2025-04-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab allows Reflected XSS.This issue affects LeadLab by wiredminds: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wiredminds-leadlab/vulnerability/wordpress-leadlab-by-wiredminds-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve