deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-57963
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows DOM-Based XSS.This issue affects Zoho Billing: from n/a through <= 4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zoho-subscriptions/vulnerability/wordpress-zoho-billing-plugin-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57964
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through <= 5.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/library-bookshelves/vulnerability/wordpress-library-bookshelves-plugin-5-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57965
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-proposals/vulnerability/wordpress-wp-proposals-plugin-2-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-57966
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.41.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gallery-lightbox-slider/vulnerability/wordpress-gallery-lightbox-plugin-1-0-0-41-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57967
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce woocommerce-lightbox allows Stored XSS.This issue affects WPB Quick View for WooCommerce: from n/a through <= 2.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-lightbox/vulnerability/wordpress-wpb-quick-view-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57968
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants-table-reservations-and-take-away-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57969
Published: 2025-09-22
Description: Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hide-wp-toolbar/vulnerability/wordpress-hide-wp-toolbar-plugin-2-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57970
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/salesmanago/vulnerability/wordpress-salesmanago-plugin-3-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57971
Published: 2025-09-22
Description: Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/salesmanago/vulnerability/wordpress-salesmanago-plugin-3-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57972
Published: 2025-09-22
Description: Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/support-ticket-system-for-woocommerce/vulnerability/wordpress-helpdesk-support-ticket-system-for-woocommerce-plugin-2-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57973
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-members/vulnerability/wordpress-wp-members-plugin-3-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57974
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tz-plus-gallery/vulnerability/wordpress-tz-plusgallery-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57975
Published: 2025-09-22
Description: Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tlp-team/vulnerability/wordpress-team-plugin-5-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57976
Published: 2025-09-22
Description: Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-cardcom-payment-gateway/vulnerability/wordpress-cardcom-payment-gateway-plugin-3-5-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57977
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flexible-invoices/vulnerability/wordpress-flexible-pdf-invoices-for-woocommerce-wordpress-plugin-6-0-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57978
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross Site Request Forgery.This issue affects Advanced Appointment Booking & Scheduling: from n/a through <= 2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/advanced-appointment-booking-scheduling/vulnerability/wordpress-advanced-appointment-booking-scheduling-plugin-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57979
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS.This issue affects AuthorSure: from n/a through <= 2.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/authorsure/vulnerability/wordpress-authorsure-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57980
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit safety-exit allows Stored XSS.This issue affects Safety Exit: from n/a through <= 1.8.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/safety-exit/vulnerability/wordpress-safety-exit-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57981
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57982
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allows Stored XSS.This issue affects Advance Portfolio Grid: from n/a through <= 1.07.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advance-portfolio-grid/vulnerability/wordpress-advance-portfolio-grid-plugin-1-07-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57983
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bp-disable-activation-reloaded/vulnerability/wordpress-bp-disable-activation-reloaded-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57984
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/makestories-helper/vulnerability/wordpress-makestories-for-google-web-stories-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-57985
Published: 2025-09-22
Description: Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-watermark/vulnerability/wordpress-ultimate-watermark-plugin-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57986
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle wp-subtitle allows Stored XSS.This issue affects WP Subtitle: from n/a through <= 3.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-subtitle/vulnerability/wordpress-wp-subtitle-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57987
Published: 2025-09-22
Description: Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through <= 2.2.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-events-manager/vulnerability/wordpress-wp-events-manager-plugin-2-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57988
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-plugin-3-0-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57989
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brajesh Singh WordPress Widgets Shortcode wp-widgets-shortcode allows Stored XSS.This issue affects WordPress Widgets Shortcode: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-widgets-shortcode/vulnerability/wordpress-wordpress-widgets-shortcode-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57990
Published: 2025-09-22
Description: Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blog Designer: from n/a through <= 3.1.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/blog-designer/vulnerability/wordpress-blog-designer-plugin-3-1-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57991
Published: 2025-09-22
Description: Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clariti: from n/a through <= 1.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/clariti/vulnerability/wordpress-clariti-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57992
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in InterServer Mail Baby SMTP mail-baby-smtp allows Cross Site Request Forgery.This issue affects Mail Baby SMTP: from n/a through <= 2.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mail-baby-smtp/vulnerability/wordpress-mail-baby-smtp-plugin-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57993
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Pick Geolocation IP Detection geoip-detect allows Stored XSS.This issue affects Geolocation IP Detection: from n/a through <= 5.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/geoip-detect/vulnerability/wordpress-geolocation-ip-detection-plugin-5-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57994
Published: 2025-09-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upcoming Events Lists: from n/a through <= 1.4.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/upcoming-events-lists/vulnerability/wordpress-upcoming-events-lists-plugin-1-4-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-57995
Published: 2025-09-22
Description: Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dethemekit-for-elementor/vulnerability/wordpress-dethemekit-for-elementor-plugin-2-1-10-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-57996
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue affects Buckets: from n/a through <= 0.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/buckets/vulnerability/wordpress-buckets-plugin-0-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57997
Published: 2025-09-22
Description: Missing Authorization vulnerability in Trustpilot Trustpilot Reviews trustpilot-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trustpilot Reviews: from n/a through <= 2.5.925.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/trustpilot-reviews/vulnerability/wordpress-trustpilot-reviews-plugin-2-5-925-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57998
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Reza Yazdani E-namad & Shamed Logo Manager e-namad-shamed-logo-manager allows Stored XSS.This issue affects E-namad & Shamed Logo Manager: from n/a through <= 2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/e-namad-shamed-logo-manager/vulnerability/wordpress-e-namad-shamed-logo-manager-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57999
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows DOM-Based XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpkoi-templates-for-elementor/vulnerability/wordpress-wpkoi-templates-for-elementor-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58000
Published: 2025-09-22
Description: Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/memberful-wp/vulnerability/wordpress-memberful-plugin-1-75-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58001
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/compact-archives/vulnerability/wordpress-compact-archives-plugin-4-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58002
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD bbPress Tools gd-bbpress-tools allows DOM-Based XSS.This issue affects GD bbPress Tools: from n/a through <= 3.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gd-bbpress-tools/vulnerability/wordpress-gd-bbpress-tools-plugin-3-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58003
Published: 2025-09-22
Description: Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/javo-core/vulnerability/wordpress-javo-core-plugin-3-0-0-266-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58004
Published: 2025-09-22
Description: Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/dricub-driving-school/vulnerability/wordpress-dricub-theme-2-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58005
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Theme/dricub-driving-school/vulnerability/wordpress-dricub-theme-2-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58006
Published: 2025-09-22
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-4-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-58007
Published: 2025-09-22
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through <= 1.35.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/social-pug/vulnerability/wordpress-social-pug-plugin-1-35-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-58008
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/participants-database/vulnerability/wordpress-participants-database-plugin-2-7-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58009
Published: 2025-09-22
Description: Missing Authorization vulnerability in codepeople CP Multi View Event Calendar  cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.
CVSS Score: 3.8 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cp-multi-view-calendar/vulnerability/wordpress-cp-multi-view-event-calendar-plugin-1-4-32-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58010
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects SV Proven Expert: from n/a through <= 2.0.06.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sv-provenexpert/vulnerability/wordpress-sv-proven-expert-plugin-2-0-06-cross-site-request-forgery-csrf-vulnerability?_s_id=cve