deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27932
Published: 2025-03-28
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an attacker may delete a file on the device or cause a denial of service (DoS) condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN04278547/; https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5
CVE: CVE-2019-16149
Published: 2025-03-28
Description: An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/psirt/FG-IR-19-072
CVE: CVE-2024-10307
Published: 2025-03-28
Description: An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/500497; https://hackerone.com/reports/2775113
CVE: CVE-2024-12619
Published: 2025-03-28
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/509324; https://hackerone.com/reports/2888260
CVE: CVE-2025-27001
Published: 2025-03-28
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Shipmondo – A complete shipping solution for WooCommerce: from n/a through <= 5.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/pakkelabels-for-woocommerce/vulnerability/wordpress-shipmondo-a-complete-shipping-solution-for-woocommerce-plugin-5-0-3-authenticated-arbitrary-wordpress-option-disclosure-vulnerability?_s_id=cve
CVE: CVE-2025-31073
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/unlimited/vulnerability/wordpress-unlimited-1-45-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31075
Published: 2025-03-28
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/paid-membership/vulnerability/wordpress-micropayments-plugin-2-9-29-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31076
Published: 2025-03-28
Description: Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects WP Compress for MainWP: from n/a through <= 6.30.03.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-mainwp/vulnerability/wordpress-wp-compress-for-mainwp-plugin-6-30-03-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-31077
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31079
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in usermaven Usermaven usermaven allows Cross Site Request Forgery.This issue affects Usermaven: from n/a through <= 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/usermaven/vulnerability/wordpress-usermaven-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31083
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Stored XSS.This issue affects Leaky Paywall: from n/a through <= 4.21.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leaky-paywall/vulnerability/wordpress-leaky-paywall-4-21-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31088
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through <= 2.14.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-14-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31090
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector dropdown-multisite-selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through < 0.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dropdown-multisite-selector/vulnerability/wordpress-dropdown-multisite-selector-0-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31093
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content rps-include-content allows DOM-Based XSS.This issue affects RPS Include Content: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rps-include-content/vulnerability/wordpress-rps-include-content-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31094
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-posts-carousel/vulnerability/wordpress-wp-posts-carousel-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31096
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.1.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-postx-4-1-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31099
Published: 2025-03-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL Injection.This issue affects Slider by BestWebSoft: from n/a through <= 1.1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/slider-bws/vulnerability/wordpress-slider-by-bestwebsoft-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31102
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hostel/vulnerability/wordpress-hostel-plugin-1-1-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2021-24008
Published: 2025-03-28
Description: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS version 5.4.0, version 5.3.2 and below, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, version 4.6.0, version 4.5.0, version 4.4.2 and below, FortiDDoS-CM version 5.3.0, version 5.2.0, version 5.1.0, version 5.0.0, version 4.7.0, FortiVoice version 6.0.6 and below, FortiRecorder version 6.0.3 and below and FortiMail version 6.4.1 and below, version 6.2.4 and below, version 6.0.9 and below may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.fortinet.com/psirt/FG-IR-20-105
CVE: CVE-2025-2868
Published: 2025-03-28
Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE: CVE-2025-2869
Published: 2025-03-28
Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE: CVE-2025-2870
Published: 2025-03-28
Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE: CVE-2025-2815
Published: 2025-03-28
Description: The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3262319%40administrator-z&new=3262319%40administrator-z&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/32725074-5c62-49e0-83f9-c6cb77fb77a4?source=cve
CVE: CVE-2025-31432
Published: 2025-03-28
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allows PHP Local File Inclusion.This issue affects Pop-Up Chop Chop: from n/a through <= 2.1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/pop-up/vulnerability/wordpress-pop-up-chop-chop-2-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31433
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through <= 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-embed-facebook/vulnerability/wordpress-magic-embeds-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31434
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Stored XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through <= 7.5.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/formlift/vulnerability/wordpress-formlift-for-infusionsoft-web-forms-7-5-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31435
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: from n/a through <= 2.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/microblog-poster/vulnerability/wordpress-microblog-poster-plugin-2-1-6-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31437
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Miller WP-OGP wp-ogp allows Stored XSS.This issue affects WP-OGP: from n/a through <= 1.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-ogp/vulnerability/wordpress-wp-ogp-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31438
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersized: from n/a through <= 3.1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-supersized/vulnerability/wordpress-wp-supersized-3-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31439
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in tobias_.MerZ Browser Caching with .htaccess allows Cross Site Request Forgery. This issue affects Browser Caching with .htaccess: from 1.2.1 through n/a.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/browser-caching-with-htaccess/vulnerability/wordpress-browser-caching-with-htaccess-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31440
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/terms-of-use-2/vulnerability/wordpress-terms-of-use-plugin-2-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31443
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof Furtak KK I Like It kk-i-like-it allows Stored XSS.This issue affects KK I Like It: from n/a through <= 1.7.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/kk-i-like-it/vulnerability/wordpress-kk-i-like-it-plugin-1-7-5-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31444
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in youtag ShowTime Slideshow showtime-slideshow allows Stored XSS.This issue affects ShowTime Slideshow: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/showtime-slideshow/vulnerability/wordpress-showtime-slideshow-plugin-1-6-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31447
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site Request Forgery.This issue affects NertWorks All in One Social Share Tools: from n/a through <= 1.26.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/nertworks-all-in-one-social-share-tools/vulnerability/wordpress-nertworks-all-in-one-social-share-tools-1-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31448
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler simple-trackback-disabler allows Cross Site Request Forgery.This issue affects Simple Trackback Disabler: from n/a through <= 1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-trackback-disabler/vulnerability/wordpress-simple-trackback-disabler-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31449
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter the-visitor-counter allows Stored XSS.This issue affects The Visitor Counter: from n/a through <= 1.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/the-visitor-counter/vulnerability/wordpress-the-visitor-counter-plugin-1-4-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31450
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box toggle-box allows Stored XSS.This issue affects Toggle Box: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/toggle-box/vulnerability/wordpress-toggle-box-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31451
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce wbounce allows Stored XSS.This issue affects wBounce: from n/a through <= 1.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wbounce/vulnerability/wordpress-wbounce-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31452
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search wp-ultimate-search allows Stored XSS.This issue affects WP Ultimate Search: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-ultimate-search/vulnerability/wordpress-wp-ultimate-search-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31453
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery youtube-simplegallery allows Stored XSS.This issue affects YouTube SimpleGallery: from n/a through <= 2.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/youtube-simplegallery/vulnerability/wordpress-youtube-simplegallery-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31456
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affects Ultimate Security Checker: from n/a through <= 4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-security-checker/vulnerability/wordpress-ultimate-security-checker-plugin-4-2-cross-site-request-forgery-csrf-to-security-rescan-vulnerability?_s_id=cve
CVE: CVE-2025-31457
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS lws-sms allows Cross Site Request Forgery.This issue affects LWS SMS: from n/a through <= 2.4.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/lws-sms/vulnerability/wordpress-lws-sms-2-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31458
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder video-embedder allows Stored XSS.This issue affects Video Embedder: from n/a through <= 1.7.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/video-embedder/vulnerability/wordpress-video-embedder-plugin-1-7-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31459
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <= 0.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/login-alert/vulnerability/wordpress-login-alert-plugin-0-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31460
Published: 2025-03-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager omnileads-scripts-and-tags-manager allows Stored XSS.This issue affects OmniLeads Scripts and Tags Manager: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/omnileads-scripts-and-tags-manager/vulnerability/wordpress-omnileads-scripts-and-tags-manager-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31463
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows Stored XSS.This issue affects TGG WP Optimizer: from n/a through <= 1.25.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tgg-wp-optimizer/vulnerability/wordpress-tgg-wp-optimizer-1-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31464
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color text-selection-color allows Stored XSS.This issue affects Text Selection Color: from n/a through <= 1.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/text-selection-color/vulnerability/wordpress-text-selection-color-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31465
Published: 2025-03-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornershop Better Section Navigation Widget better-section-navigation allows Stored XSS.This issue affects Better Section Navigation Widget: from n/a through <= 1.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/better-section-navigation/vulnerability/wordpress-better-section-navigation-widget-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve