rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-32262 WordPress RDP Wiki Embed plugin <= 1.2.20 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Robert D Payne RDP Wiki Embed rdp-wiki-embed allows Cross Site Request Forgery.This issue affects RDP Wiki Embed: from n/a through <= 1.2.20.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Robert D Payne
product: RDP Wiki Embed
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:38.154Z
CVE-2025-32263 WordPress Sequential Order Numbers for WooCommerce plugin <= 3.6.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in BeRocket Sequential Order Numbers for WooCommerce sequential-order-numbers-for-woocommerce allows Cross Site Request Forgery.This issue affects Sequential Order Numbers for WooCommerce: from n/a through <= 3.6.2.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: BeRocket
product: Sequential Order Numbers for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Skalucy | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:38.824Z
CVE-2025-32264 WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Cross Site Request Forgery.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Saiful Islam
product: UltraAddons Elementor Lite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:39.503Z
CVE-2025-32265 WordPress JobWP plugin <= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.3.9.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Hossni Mubarak
product: JobWP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Skalucy | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:40.160Z
CVE-2025-32266 WordPress 404 Image Redirection (Replace Broken Images) plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: wp-buy
product: 404 Image Redirection (Replace Broken Images)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:40.870Z
CVE-2025-32267 WordPress WP to Hootsuite plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite wp-to-hootsuite allows Cross Site Request Forgery.This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through <= 1.5.8.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: wpzinc
product: Post to Social Media – WordPress to Hootsuite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nabil Irawan | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:41.905Z
CVE-2025-32268 WordPress QR Code Tag for WC plugin <= 1.9.42 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC qr-code-tag-for-wc-from-goaskle-com allows Cross Site Request Forgery.This issue affects QR Code Tag for WC: from n/a through <= 1.9.42.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: www.15.to
product: QR Code Tag for WC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:42.535Z
CVE-2025-32269 WordPress  WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows Cross Site Request Forgery.This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.3.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: CRM Perks
product: WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:43.268Z
CVE-2025-32270 WordPress Broadstreet plugin <= 1.52.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Broadstreet
product: Broadstreet Ads
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:43.923Z
CVE-2025-32271 WordPress Woocommerce Role Pricing Plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing woocommerce-role-pricing allows Cross Site Request Forgery.This issue affects Woocommerce Role Pricing: from n/a through <= 3.5.6.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: ablancodev
product: Woocommerce Role Pricing
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:44.635Z
CVE-2025-32272 WordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through <= 1.0.46.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: PickPlugins
product: Wishlist
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: LVT-tholv2k | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:45.434Z
CVE-2025-32273 WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This issue affects Freetobook Responsive Widget: from n/a through <= 1.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: freetobook
product: Freetobook Responsive Widget
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:46.031Z
CVE-2025-32274 WordPress w3all phpBB integration Plugin <= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3all phpBB: from n/a through <= 2.9.8.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: axew3
product: WP w3all phpBB
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Xuan Chien | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:46.707Z
CVE-2025-32275 WordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through <= 5.1.6.3.
Problem types: cwe_id: CWE-290
description: Authentication Bypass by Spoofing
Affected products: vendor: Ays Pro
product: Survey Maker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Martino Spagnuolo (r3verii) | Patchstack Bug Bounty Program
Published: 2025-04-10T08:09:47.813Z
CVE-2025-32276 WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator Z: from n/a through <= 2026.03.02.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Quý Lê 91
product: Administrator Z
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Chazz Wolcott (Patchstack)
Published: 2025-04-04T15:59:47.428Z
CVE-2025-32277 WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through <= 3.8213.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Ateeq Rafeeq
product: RepairBuddy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dhabaleshwar Das | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:48.123Z
CVE-2025-32278 WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual riovizual allows Cross Site Request Forgery.This issue affects Table Block by RioVizual: from n/a through <= 2.3.1.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: wprio
product: Table Block by RioVizual
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:48.783Z
CVE-2025-32279 WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Shahjada
product: Live Forms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika | Patchstack Bug Bounty Program
Published: 2025-04-08T16:59:34.603Z
CVE-2025-32280 WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: weDevs
product: WP Project Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Manab Jyoti Dowarah | Patchstack Bug Bounty Program
Published: 2025-04-04T15:59:49.424Z
CVE-2025-32281 WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a through <= 1.2.8.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: DarkMySite
product: DarkMySite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: SOPROBRO | Patchstack Bug Bounty Program
Published: 2025-06-27T11:52:36.905Z
CVE-2025-32282 WordPress ShareThis Dashboard for Google Analytics plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through <= 3.2.3.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: ShareThis
product: ShareThis Dashboard for Google Analytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Rafie Muhammad | Patchstack Bug Bounty Program
Published: 2025-04-10T08:09:48.186Z
CVE-2025-32283 WordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data
Affected products: vendor: designthemes
product: Solar Energy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-10-22T14:32:05.260Z
CVE-2025-32284 WordPress Pet World theme <= 2.8 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2.8.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data
Affected products: vendor: designthemes
product: Pet World
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-05-23T12:44:00.122Z
CVE-2025-32285 WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through < 2.54.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ApusTheme
product: Butcher
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-05-23T12:43:59.597Z
CVE-2025-32286 WordPress Butcher theme <= 2.40 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Butcher butcher allows PHP Local File Inclusion.This issue affects Butcher: from n/a through <= 2.40.
Problem types: cwe_id: CWE-98
description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: ApusTheme
product: Butcher
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-05-23T12:43:59.141Z
CVE-2025-32287 WordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.7.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LambertGroup
product: Responsive HTML5 Audio Player PRO With Playlist
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
Published: 2025-05-16T15:45:32.563Z